Brief of Former Antitrust Enforcers to the 9th Circuit in Epic v Apple

INTEREST OF AMICI CURIAE[1]

Amici curiae are former government officials with significant experience enforcing federal antitrust laws on behalf of the United States Department of Justice and/or the Federal Trade Commission. Amici are leading voices in the antitrust field; they have testified as experts before Congress, taught at top-tier educational institutions, published leading antitrust articles, and been cited in federal antitrust decisions.

In their capacity as former enforcement officials—and as antitrust practitioners, academics, and economists—amici have a substantial interest in the consistent enforcement, coherent interpretation, and predictable application of antitrust laws. Background details for each of the amici are set forth in an Addendum to this brief.

INTRODUCTION AND SUMMARY OF ARGUMENT[2]

The Supreme Court recently emphasized that “caution is key” “[w]hen it comes to fashioning an antitrust remedy.” NCAA v. Alston, 594 U.S. 69, 106 (2021). Caution is necessary because even well-intentioned judicial remedies can have unintended anticompetitive consequences that undermine the purpose of our antitrust laws. As a result, “markets are often more effective than the heavy hand of judicial power when it comes to enhancing consumer welfare.” Id.

Here, the panel failed to heed that caution when it “recommend[ed] some possible courses of action to the district court regarding an appropriate commission or fee limitation on remand.” Op. 41. Specifically, the panel suggested that Apple may recover only the direct costs of implementing linked-out purchases, even if a higher commission would not be “prohibitive.” Op. 40; see id. at 41-42. If left uncorrected, the panel’s dicta could deny Apple compensation for its enormous investments in developing the App Store and other benefits to developers.

The panel’s statements at pages 41-42 of its opinion run counter to principles of sound antitrust enforcement. That language improperly seeks to micromanage private business dealings, despite clear evidence that courts are ill-equipped to regulate prices and that their doing so can chill innovation by reducing and even eliminating businesses’ ability to earn a return on innovations. If the panel opinion remains intact, it risks discouraging Apple and other technology companies from innovating, in contravention of the public interest.

ARGUMENT

THE PANEL’S PROPOSED “COURSES OF ACTION” ARE INCONSISTENT WITH ANTITRUST PRINCIPLES

The panel allowed Apple to charge some commission on linked-out purchases. Op. 36-40. But it held that Apple must set the commission at some unspecified rate that is not “prohibitive” and suggested that a commission should cover only Apple’s direct costs in facilitating such purchases. See Op. 41-42. The panel stated that a commission should be “based on the costs that are genuinely and reasonably necessary for [Apple’s] coordination of external links for linked-out purchases, but no more.” Id. at 41. And it further suggested that Apple may only receive “compensation for the use of its intellectual property that is directly used in permitting Epic and others to consummate linked-out purchases.” Id. at 41-42. The panel erred in seeking to micromanage Apple’s charging of commissions for linked-out purchases.

A.     Antitrust Courts Should Avoid Dictating Businesses’ Prices and Terms of Dealing

“As a general rule, businesses are free to choose the parties with whom they will deal, as well as the prices, terms, and conditions of that dealing.” Pac. Bell Tel. Co. v. lifeLine Commc’ns, Inc., 555 U.S. 438, 448 (2009). For that reason, the Sherman Act “does not restrict the long recognized right” of a “private business[] freely to exercise [its] own independent discretion as to parties with whom [it] will deal.” United States v. Colgate & Co., 250 U.S. 300, 307 (1919). Nor does the Sherman Act mandate that a private business charge only a “fair” or “reasonable” price. Town of Concord v. Bos. Edison Co., 915 F.2d 17, 25 (1st Cir. 1990) (Breyer, J.). To the contrary, “possession of monopoly power, and the concomitant charging of monopoly prices” is “not unlawful” and “is an important element of the free-market system[,]” because “[t]he opportunity to charge monopoly prices-at least for a short period-is what attracts ‘business acumen’ in the first place.” Verizon Commc’ns Inc. v. Law Offices of Curtis V. Trinko, LLP, 540 U.S. 398, 407 (2004).

Those principles accord with “the fundamental national values of free enterprise and economic competition that are embodied in the federal antitrust laws.” FTC v. Phoebe Putney Health Sys., Inc., 568 U.S. 216, 225 (2013). If firms were compelled to “share the source of their advantage” or to charge less than the market would accept, then they would have reduced incentives to invest. Trinko, 540 U.S. at 407-08. Critically here, intrusive judicial remedies can be particularly damaging to “technological markets, where innovation ‘is essential to economic growth and social welfare’ and ‘an erroneous decision will deny large consumer benefits.” FTC v. Qualcomm Inc., 969 F.3d 974, 991 (9th Cir. 2020); cf. Phillip E. Areeda and Herbert Hovenkamp, Antitrust Law: An Analysis of Antitrust Principles and Their Application, § l739f4(C) (2d ed. 2017) (“[I]nte11ectua1 property is often characterized by large upfront costs, and the IP holder must earn enough to cover these as well as marginal costs.”) .

The foregoing principles also reflect that “judges make for poor ‘central planners’ and should never aspire to the role.” Alston, 594 U.S. at 103. “[A]s generalists, as lawyers, and as outsiders,” courts should remain cognizant of “their limitations” when “trying to understand intricate business relationships,” id. at 106-“especially in technology markets,” Qualcomm, 969 F.3d at 990. Judges should “avoid direct price administration” in particular because it is largely impossible to “determine a ‘fair price”‘ “without acting like a rate-setting regulatory agency, the rate-setting proceedings of which often last for several years.” Town of Concord, 915 F.2d at 25. Indeed, “[t]he reasonable price fixed today may through economic and business changes become the unreasonable price of tomorrow.” United States v. Trenton Potteries Co., 273 U.S. 392, 397 (1927) (cleaned up).

B.     The Panel Opinion Improperly Seeks to Dictate Apple’s Prices and Terms of Dealing

The panel opinion’s proposed “course[] of action” for remand is inconsistent with these established principles. Op. 41. That portion of the opinion micromanages granular details of Apple’s dealings with developers, and it appears to restrict Apple’s commissions on linked-out purchases to its direct costs—even if a commission that would adequately compensate Apple for the use of its intellectual property would not be “prohibitive.” Id. at 40-42. The panel took these steps even though Apple’s specific practices for outside-app purchases have hardly been scrutinized, let alone deemed unlawful.

To be sure, the panel modified certain aspects of the district court’s order and did not accept the district court’s complete ban on commissions. Op. 40-41. But the panel’s recommended “courses of action” on remand raise problems of their own. As Apple explains—and as Epic has represented—the panel opinion could be read to bar all commissions above a de minimis level, disregarding the value of Apple’s innovation and intellectual property and effectively restoring the district court’s zero-commission rule. See id. at 41-42, see Pet. 1-2, 6-7. That is precisely the type of “direct price administration” that “antitrust courts normally avoid.” Town of Concord, 915 F.2d at 25.

Moreover, the panel opinion raises serious administrability concerns. In setting a permissible commission rate, it is far from clear how Apple—or a court—should determine which costs are “genuinely and reasonably necessary,” or which intellectual property is “directly used, in facilitating linked-out purchases. Op. 41-42. As one example, the App Store provides visibility and distribution services for the apps it features—must the costs of developing the App Store somehow be apportioned to all apps in this calculus? And costs change frequently—does a permissible commission rate suddenly become “prohibitive” when Apple reduces one cost involved in purchases? The panel offers no guidance, and its amorphous direct costs standard only underscores the extent to which “identifying the proper price, quantity, and other terms of dealing” is “a role for which [courts] are ill suited.” Trinko, 540 U.S. at 408.

If left intact, the panel’s proposed approach could force Apple to share the fruits of its labor with developers at little to no cost (and with no commensurate gain). Millions of consumers and developers benefit from the App Store, and Apple incurred significant costs to develop it. Apple monetizes the App Store through its commissions, and no clear alternative monetization structure exists, especially given the wide variety of developers who use the App Store. And in particular, restrictions on outside-app purchases are necessary to prevent freeriding and to allow Apple to earn a return on its substantial investments in its intellectual property and other benefits for developers.

Courts and antitrust enforcers have long understood the dangers of forced-sharing remedies like the one that the panel opinion appears to envision here. Such obligations are in “tension with the underlying purpose of antitrust law, since [they] may lessen the incentive for the monopolist, the rival, or both to invest in … economically beneficial facilities.” Trinko, 540 U.S. at 407-08. There is no “guarantee that firms will undertake the investment necessary to produce complex technological innovations knowing that any competitive advantage deriving from those innovations will be dissipated by the sharing requirement.” AT&T Corp. v. Iowa Utils. Bd., 525 U.S. 366, 429 (1999) (Breyer, J., concurring in part and dissenting in part). That is why “[e]ven a monopolist generally has no duty to share (or continue to share) its intellectual or physical property with a rival.” Novell, Inc. v. Microsoft Corp., 731 F.3d 1064, 1074 (loth Cir. 2013) (Gorsuch, J.). Thus, whether viewed as price setting or compulsory sharing, the panel’s apparent approach to commissions is antithetical to the goals and principles of antitrust law. For that reason, the relief envisioned by the panel opinion would be contrary to “the public interest.” Winter v. Nat. Res. Def. Council, 555 U.S. 7, 32 (2008).

The panel opinion could also have important practical consequences. Apple made significant investments to create the iPhone and develop the iOS ecosystem. Forcing Apple to give developers access to its intellectual property without adequate compensation invites free riding and discourages the type of “risk taking that produces innovation and economic growth.” Trinko, 540 U.S. at 407. Those consequences are not limited to Apple alone-any would-be developer may rationally decide not to invest in new technology with no clear path to monetizing it. And when the law discourages innovation, the ultimate losers are consumers. See Gorlick District. Ctrs., LLC v. Car Sound Exhaust Sys., Inc., 723 F.3d lol9, 1026 (9th Cir. 2013) (observing that “free-riding could ultimately hurt consumers”).

CONCLUSION

For the foregoing reasons, this Court should grant Apple’s rehearing petition.

[1] No party or party’s counsel authored this brief in whole or in part, and no one other than amici and their counsel has made a monetary contribution to this briefs preparation and submission. Cooley represents Apple in other unrelated matters, and some amici may be affiliated with firms that similarly represent Apple in other unrelated matters.

[2] Unless otherwise indicated, all internal citations and quotations are omitted.

I. Introduction

We appreciate the opportunity to contribute to the European Commission’s Digital Fitness Check.[1] The International Center for Law & Economics (ICLE) is a nonprofit, nonpartisan global research and policy centre dedicated to building the intellectual foundations for sensible, economically grounded policy. ICLE applies law & economics methodologies to inform public-policy debates on technology governance, competition, and consumer-protection policy. Our interest is to ensure that the EU’s digital rulebook promotes consumer welfare, innovation, and competitiveness through clear, predictable, and proportionate rules grounded in evidence and sound economics.

The Digital Fitness Check is both timely and necessary. The Commission’s recognition that the cumulative effects of EU digital regulation require systematic evaluation reflects concerns raised by ICLE and many other stakeholders. The Draghi Report, the Letta Report, and the Commission’s own Competitiveness Compass all acknowledge that the accumulation of EU digital rules may have unintended consequences for innovation and competitiveness, particularly for small and medium-sized enterprises.[2]

Unlike the Digital Omnibus—which focused on targeted, incremental reforms—the Fitness Check creates an opportunity to examine deeper structural features of the EU digital rulebook. Over time, successive legislative initiatives have produced a dense regulatory framework characterised by three recurring structural problems: weak empirical foundations for regulation, definitional and institutional spillovers across instruments, and cumulative compliance burdens that are rarely evaluated systematically. Evaluating the rulebook as an integrated system is therefore essential to ensuring that EU digital regulation supports, rather than undermines, innovation, competition, and European competitiveness.

These comments are organised as follows. Section II addresses the need for methodological rigour in the Fitness Check, including the assessment of indirect effects, the gap between projected and actual compliance costs, and the problem of last-minute legislative additions that bypass the impact-assessment process. Section III examines definitional spillovers across the EU digital rulebook, focusing in particular on the migration of key concepts—such as the DMA’s ‘gatekeeper’ designation and the DSA’s ‘very large online platform’ category—across instruments in ways that were never properly assessed. Section IV analyses the risk of an anti-commons dynamic created by overlapping data regulations, with particular attention to the interaction between the GDPR and the DMA and its implications for data use and artificial-intelligence development. Section V evaluates the institutional framework for enforcement, including the persistent under-resourcing of national supervisory authorities and the coordination challenges created by the growing number of EU and national regulators overseeing digital markets. Section VI examines the cumulative impact of the digital rulebook on startups, innovation, and European competitiveness, drawing on empirical evidence from the implementation of the GDPR and broader research on regulatory burdens in dynamic markets. Section VII concludes.

II. Evaluating the Costs and Outcomes of EU Digital Regulation

The Digital Fitness Check should be more than a mapping exercise. It should assess whether the EU’s digital rules achieve their stated objectives at the lowest effective cost. This requires more than a narrow inquiry into regulatory efficiency. It calls for a broader evaluation of how these rules affect innovation, competition, and economic growth.

Europe faces what many policymakers have described as an “existential challenge”.[3] That moment demands more than superficial reforms or procedural simplification. President Ursula von der Leyen emphasised this point at the ‘One Year After the Draghi Report’ conference, calling for a renewed “sense of urgency” and “ambition”, alongside “less paperwork, less overlaps, less complex rules”.[4] The Fitness Check should reflect that spirit. It should approach the EU’s digital rulebook with sufficient openness—and regulatory humility—to revise or repeal measures where evidence shows negative effects, or where claimed benefits remain uncertain.

The Commission’s Communication on ‘A Simpler and Faster Europe’ commits to reducing administrative costs by 25 per cent for all firms and 35 per cent for SMEs, from a baseline estimated at roughly €150 billion.[5] These are ambitious targets. The Fitness Check should provide the analytical foundation needed to meet them.

The call for evidence identifies many of the right questions, including definitional coherence, cumulative cost–benefit analysis, governance interplay, and opportunities for streamlining.[6] Experience with earlier impact assessments nonetheless suggests that the Commission’s methodology will require strengthening if the Fitness Check is to produce actionable findings.

A. Impact Assessments Miss Indirect Costs

A recurring weakness in Commission impact assessments is the failure to capture significant indirect effects of regulation. As we observed in our Digital Omnibus submission, current assessments tend to focus on the direct compliance costs borne by regulated firms while overlooking the economic consequences for third parties—e.g., “business users”—that depend on regulated services.[7]

This omission is particularly problematic in digital markets. Platforms typically act as intermediaries connecting multiple groups of users. When regulation degrades a platform’s functionality or service quality, the resulting costs do not remain confined to the platform operator. They spread across the wider ecosystem—to business users, advertisers, content creators, and consumers who rely on those services.

B. Compliance Costs Are Systematically Underestimated

Impact assessments have not only overlooked indirect costs. They have also consistently underestimated the direct compliance costs imposed on regulated firms. The Digital Markets Act (DMA) illustrates the problem.

The Commission’s impact assessment projected total compliance costs for all designated gatekeepers of approximately €21–28 million.^[8] Those figures bear little resemblance to the actual costs reported by firms. As Mikolaj Barczentewicz explains in an analysis of the DMA compliance workshops held in 2025:

During recent DMA workshops, Amazon revealed that its compliance costs have been “multiple orders of magnitude beyond that predicted amount.” This carefully chosen phrase suggests costs potentially reaching hundreds of millions of euros annually for Amazon alone. Meta representatives acknowledged that reality has dwarfed initial third-party estimates of $10-20 million per year. As one Meta representative noted, “we’re a long way north of that.”

The human resource allocation tells an equally striking story.

• Apple’s “engineers have spent hundreds of thousands of hours to bring everything to life, often on incredibly compressed timelines.” There are “thousands of employees at Apple involved in dealing with the impact of the DMA in engineering, design, operations, marketing, and more.”

• Meta has deployed over 11,000 employees working on DMA compliance design, build, and implementation—investing close to 600,000 engineering hours, equivalent to over six decades of engineering work compressed into a two-year period.

• Google assigned approximately 3,000 people, mostly engineers, working full-time for two years just on Article 5(2) compliance alone. [9]

Other estimates suggest even broader economic costs. A 2025 report estimated that EU digital-services regulation imposes up to $97.6 billion annually in total costs once lost revenue is included. Compliance costs alone were estimated at $2.2 billion per year.[10]

These figures still understate the true burden because they omit opportunity costs. Every engineering hour devoted to regulatory compliance is an hour not spent on innovation that could benefit European consumers. As an Amazon representative explained during the DMA workshops:

…any dollar that you spend or euro that you spend on work necessarily takes away that work from other areas that you could be innovating and providing benefits to customers in Europe.[11]

C. The RSB Identified These Problems Early

These shortcomings are not merely external critiques. The Commission’s own Regulatory Scrutiny Board (RSB)—an independent body responsible for evaluating the quality of Commission impact assessments—raised fundamental concerns about the DMA before the regulation was adopted.

The RSB issued an initial negative opinion on the DMA impact assessment, concluding that the analysis:

… does not sufficiently justify the restriction of its scope to digital markets. It does not justify the selection of platform services within the digital sector nor does it clarify the concept of gatekeeper platforms.

… does not provide policymakers with real choices on the different policy options. It does not provide a full range of options and it does not develop these in sufficient detail. It therefore cannot assess their impacts on different stakeholders.^[12]

This negative opinion forced a substantial revision of the proposal before its formal publication in December 2020. Yet even after revisions, the RSB continued to identify what it described as “significant shortcomings”. The Board also found that the report did not fully justify the selection of the core platform services covered by the regulation and failed to define adequately several measures included in the different policy options.[13]

The Board further urged the Commission to clarify the causal link between alleged market failures and the harms identified, and to consider the potential costs of curtailing size advantages arising from network economies and economies of scale.^[14] In essence, the RSB questioned whether the evidence demonstrated that the targeted practices produced the harms the DMA sought to address—and whether the regulation itself might eliminate efficiencies that benefit consumers.

D. DMA Enforcement Reveals Unintended Consequences

These findings matter for the Fitness Check for two reasons.

First, they show that many of the evidentiary weaknesses now visible in DMA enforcement—including unintended consequences for European hotels and the withdrawal of political-advertising services discussed below—were foreseeable. The Commission’s own oversight body raised them at the outset.

Second, they suggest that the impact-assessment process, as currently structured, lacks sufficient authority to prevent inadequately supported proposals from advancing to legislation. The Fitness Check should therefore treat the RSB’s conclusions as a starting point for evaluating whether DMA obligations are appropriately calibrated to the harms they were meant to address and whether the assumptions underpinning those obligations have been borne out in practice.

More broadly, RSB opinions should carry greater weight in the legislative process so that the Board’s quality-control function cannot be routinely overridden by political imperatives.

Recent enforcement experience further illustrates the risks of poorly calibrated regulation. Available evidence suggests that EU hotels experienced a significant decline in direct traffic following DMA enforcement against Google Search, with gains accruing disproportionately to large travel intermediaries, rather than to the smaller European businesses the DMA was intended to support.[15]

Regulatory uncertainty has also delayed access to new products for European consumers. Google’s Gemini AI and Meta’s Threads were available abroad months before their EU launch. Google’s AI Overviews—which provide multi-step reasoning capabilities in search results to more than one billion users worldwide—also reached European users substantially later.[16] These are precisely the kinds of indirect effects that the Fitness Check should identify and help eliminate.

E. SME and Innovation Effects Are Under-Examined

The Draghi Report reached a similar conclusion regarding the Commission’s analytical framework. It found that more than half of Commission impact assessments fail to provide sufficient detail on the needs of SMEs. It also observed that the EU lacks both a commonly agreed definition of ‘small mid-caps’ and readily available statistical data on them.[17]

The Fitness Check should therefore adopt a methodology that goes beyond mapping overlaps. It should measure the cumulative economic impact of EU digital rules across firms of all sizes, including indirect effects on business users of regulated platforms and on incentives to innovate.

F. The Legislative Process Needs Stronger Safeguards

The Fitness Check’s analytical framework will shape not only how existing rules are evaluated, but also how future legislation is designed. One persistent concern is the problem of last-minute legislative additions.

Several instruments in the Digital Package underwent substantial changes during trilogue negotiations that introduced obligations without adequate drafting or analysis. The Artificial Intelligence Act provides a prominent example. Its provisions on general-purpose AI (GPAI) were introduced late in the legislative process in response to ChatGPT’s emergence and were not subject to the impact assessment accompanying the Commission’s original proposal.[18]

The result may be legislation that inadvertently slows the EU’s adoption of critical technologies. The Commission’s current effort to ease compliance burdens through the Digital Omnibus—less than a year after the AI Act’s adoption—illustrates the problem.

The Fitness Check should therefore also address procedural safeguards. Any substantive amendment introduced after the impact-assessment stage should trigger a supplementary assessment proportionate to the amendment’s significance. Such a requirement would strengthen the evidentiary foundation of EU digital legislation and reduce the risk of poorly calibrated rules.

III. Definitional Incoherence Across the EU Digital Rulebook

Beyond methodological weaknesses in impact assessments, a second structural problem concerns definitional spillovers across the EU digital acquis. Legal regimes rarely operate in isolation. Modern economic activity—especially in digital markets—falls simultaneously under multiple regulatory frameworks, including competition law, consumer protection, and data protection. Each regime pursues distinct policy objectives, but they often regulate the same underlying conduct. When key concepts across these frameworks diverge, the result is not only conceptual confusion but regulatory spillovers, where rules designed for one policy domain reshape outcomes in another.

These spillovers create more than compliance challenges. Definitional incoherence can produce overlapping obligations, conflicting compliance requirements, weakened enforcement coordination, and legal uncertainty. As the EU digital rulebook has expanded, it has generated what commentators describe as a ‘complex matrix’ and a ‘layering of governance structures’ assembled over time for markets that were often national in scope but now operate on a supranational basis.[19] These misalignments do more than complicate interpretation. They can affect how authority is allocated among regulators, shape firms’ incentives to choose particular jurisdictions, and undermine consistent enforcement across the Union.[20]

The treatment of data across EU law illustrates the problem. Under the GDPR, personal data is framed through the lens of individual rights and informational autonomy.[21] The DMA, by contrast, treats data primarily as an economic input. It requires designated gatekeepers to enable data portability and third-party interoperability in order to lower barriers to entry in digital markets.[22] The interaction between these instruments creates tangible friction. A gatekeeper obliged, for example, under Article 6(9) of the DMA to facilitate data portability may simultaneously face GDPR constraints that limit the lawful basis or permissible scope of that transfer. In some scenarios, satisfying both regimes simultaneously may prove structurally impossible, forcing firms to prioritise one framework over the other.

The Commission and the European Data Protection Board have acknowledged this tension. Both institutions have issued draft Joint Guidelines on the interplay between the two instruments for public consultation.[23] This initiative is welcome, but further work remains necessary to reconcile the two regimes.[24]

Comparable difficulties arise in the classification of digital intermediaries. The DMA introduced the concept of a ‘gatekeeper’ to designate a small number of large platforms providing core platform services that meet specific quantitative and qualitative thresholds.[25] That concept has since migrated into other legal instruments, most notably the Data Act. Article 5(3) of the Data Act provides that any undertaking designated as a gatekeeper under Article 3 of the DMA cannot qualify as an eligible third party for purposes of receiving data at a user’s request under the Data Act’s data-sharing framework.[26]

This exclusion aims to prevent gatekeepers from leveraging internet-of-things (IoT) data to strengthen their market position. It nevertheless creates tension with the DMA’s own data-portability obligations under Article 6(9), which require gatekeepers to facilitate outbound portability to end users and authorised third parties.[27] The resulting regime is asymmetric: gatekeepers must make data available to others under the DMA but cannot receive data under the Data Act, even when users wish to share their data with a gatekeeper’s service.

This interaction was never properly assessed in the Data Act’s impact assessment, which preceded the DMA’s entry into force and the designation of specific gatekeepers. The episode illustrates a broader structural problem. When concepts designed for one regulatory context migrate into another without careful analysis of how the two instruments interact, the result is legal uncertainty and outcomes that may serve neither instrument’s objectives.

A similar concern arises with the Digital Services Act’s concept of ‘very large online platforms’ (VLOPs). VLOP designation triggers heightened obligations under the DSA, including systemic-risk assessments, independent auditing, and enhanced transparency requirements.[28] The threshold was designed for a specific regulatory purpose. Yet the concept increasingly appears in other regulatory discussions, including proposals such as the Digital Fairness Act and sector-specific legislation. Each extension risks applying obligations calibrated for one policy objective to contexts where they may be disproportionate.

Ensuring definitional coherence across the EU digital acquis therefore requires a more systematic approach.

First, the Fitness Check should conduct a cross-instrument audit of key definitions and regulatory categories across the EU digital rulebook. This exercise should identify not only textual inconsistencies but also situations in which one instrument’s concepts implicitly determine rights or duties under another.

Second, the Commission should adopt a rebuttable presumption against importing regulatory categories from one instrument into another without a dedicated impact assessment of the interaction. Concepts such as ‘gatekeeper’ or ‘VLOP’ should not become default legislative categories.

Third, where full harmonisation is neither possible nor desirable, the Union should develop conflict-management mechanisms for overlapping regimes. These may include structured cooperation clauses, clearer competence rules, express conflict provisions, and safe-harbour mechanisms for firms acting in good faith to reconcile competing obligations.

Fourth, impact assessments should evaluate cumulative effects, rather than individual instruments in isolation. The relevant question is not only whether a proposal is justified on its own terms but also how it interacts with the obligations, thresholds, and governance structures already embedded in the wider digital acquis.

The objective of the Fitness Check should not be uniformity for its own sake. It should be regulatory coherence. The EU’s digital rulebook will inevitably contain multiple regimes pursuing different policy objectives. When the same firms, technologies, and data flows are governed through inconsistent concepts transplanted across instruments without adequate justification, the result is not a coherent framework for digital governance but a layered system of potentially self-defeating obligations.

IV. Data Regulation and the Risk of an Anti-Commons

A significant problem in the EU’s digital rulebook is what could be described as an ‘anti-commons’ dynamic in the regulation of data.[29] In the classic formulation developed by Michael Heller, a tragedy of the anti-commons occurs when resources remain underutilised because too many actors hold rights to exclude others from using them.[30] In regulatory contexts, the anti-commons arises when overlapping legal regimes grant multiple authorities the power to restrict the same activity, making lawful use of a resource—here, data—difficult or impossible in practice.

The concept offers a useful lens for analysing EU data regulation, where multiple legal instruments impose distinct but cumulative restrictions on the processing, combination, and sharing of data. Each instrument is enforced by a different authority, operating under its own institutional mandate and interpretive priorities.

The joint guidelines issued by the Commission and the European Data Protection Board on the interplay between the DMA and the GDPR illustrate these tensions clearly.[31] Under Article 5(2) DMA, gatekeepers may not process, combine, or cross-use personal data across their core platform services and other services unless they obtain valid consent from end users. As the joint guidelines emphasise, this consent must satisfy the GDPR’s requirements—it must be specific, informed, and freely given.[32]

In practice, the availability of consent as a lawful basis is constrained. The Court of Justice’s judgment in Meta Platforms v. Bundeskartellamt held that a dominant market position may create power imbalances that undermine the voluntary nature of consent.[33] This interpretation significantly weakens the consent route under Article 5(2) DMA, as regulators may be inclined to presume that gatekeepers occupy such positions of power. The remaining GDPR legal bases offer little practical relief. The joint guidelines exclude reliance on ‘performance of a contract’ and ‘legitimate interests’, leaving only non-commercial bases such as compliance with a legal obligation or the protection of vital interests—grounds that rarely apply to commercial data processing.

The result is a formal legal pathway for data processing that, in practice, is largely unavailable. The likely consequence is that the use of data—including by the gatekeepers discussed above—will fall below socially optimal levels. This matters not only for gatekeepers but for the broader digital economy. Data that cannot lawfully be processed, combined, or cross-used cannot be deployed to improve services, develop new products, or train artificial-intelligence systems. The anti-commons dynamic thus produces systematic underutilisation of data and complementary assets, with consequences for compliance, consumer welfare, and innovation.[34]

The problem is compounded by the joint guidelines’ approach to consent interfaces. The guidelines require gatekeepers to obtain separate consent for each distinct processing purpose—such as personalised advertising, personalised content, and service development—through individual questions within a consent flow.[35] At the same time, they caution that the process must not create ‘choice fatigue’ for users.[36] Navigating this tension will be difficult in practice. Poorly designed consent flows could undermine the validity of consent while also risking classification as an ‘aggressive’ commercial practice under EU consumer-protection law.[37]

These requirements may therefore generate conflicting outcomes in EU data regulation. The Commission has simultaneously recognised the need to reduce cookie-consent fatigue. Requiring consent interfaces that multiply user prompts under the DMA risks producing the opposite result, creating additional complexity for both users and firms.

Similar anti-commons effects may arise in the context of artificial intelligence. AI development depends on the ability to process, combine, and cross-use large datasets to train models and improve outputs. The DMA’s restrictions on data combination and cross-use could prevent gatekeepers from using data generated across their services to train AI models.[38] The AI Act introduces an additional layer of obligations relating to training data, including requirements on data governance, bias testing, and documentation. These obligations may, at times, prove difficult to reconcile with the DMA’s and GDPR’s overlapping constraints on data use.[39]

Recent case law illustrates the uncertainty surrounding these interactions. A judgment of the Higher Regional Court of Cologne tentatively addressed the issue, concluding that Meta’s use of data from Instagram and Facebook to train generative AI models did not violate the DMA.[40] The broader legal landscape remains uncertain. Other courts or regulators across the Union could reach different conclusions regarding the interaction of these instruments.

This emerging anti-commons dynamic has clear implications for the Fitness Check. The Commission should evaluate whether the EU’s expanding body of data regulation collectively makes it less attractive to conduct data-driven activities within the Union. Such an outcome would lead to inefficient underutilisation of Europe’s data resources, with negative consequences for European consumers and businesses.

The Fitness Check should therefore examine whether the ‘without prejudice’ clauses that accompany many of these instruments operate effectively in practice or merely obscure conflicts that generate anti-commons outcomes.[41] In particular, it should assess the cumulative effects of the GDPR, the DMA, the Data Act, and the ePrivacy framework on the lawful processing and use of data. These constraints also have broader implications for the EU’s competitiveness in artificial intelligence, where access to large and diverse datasets is a key input for innovation. This analysis would help identify areas where overlapping restrictions produce inefficiencies without corresponding gains in data protection.

V. Institutional Capacity and Regulatory Coordination

Effective enforcement of EU digital regulation requires supervisory authorities with strong technical expertise, adequate financial and human resources, and sufficient operational independence to exercise their powers without undue political or market influence. The forthcoming Fitness Check should therefore examine whether the EU’s current institutional framework is equipped to deliver effective enforcement in practice. Two governance challenges deserve particular attention: institutional capacity and coordination across authorities.

The evaluation should consider whether the national authorities designated under the EU digital rulebook—including those responsible for the GDPR, the Digital Services Act, and the Digital Markets Act—possess the staffing levels, technological capabilities, and investigative expertise necessary to fulfil their increasingly complex mandates. Digital markets evolve rapidly. Regulated firms operate at a high level of technical sophistication, and many services function across borders. These realities place significant demands on regulators. Without sustained institutional capacity, enforcement risks falling short of legislative ambition.

Experience with the implementation of the GDPR offers important lessons. Although the regulation assigns central enforcement responsibilities to national data-protection authorities (DPAs), many DPAs remain significantly under-resourced relative to the scale and complexity of their tasks. This structural imbalance has contributed to the widely documented challenges associated with the GDPR’s one-stop-shop mechanism, particularly in cross-border cases involving large digital platforms. Any comprehensive evaluation of the EU digital rulebook should therefore examine not only the design of legal obligations but also whether supervisory authorities have the institutional capacity needed to enforce those obligations consistently across the Union.

A further concern relates to the limited coordination among the multiple regulatory bodies that now share oversight of digital markets. The EU’s digital regulatory framework—including the DMA, GDPR, DSA, AI Act, NIS2 Directive, Data Act, and several sector-specific regimes—allocates supervisory and enforcement responsibilities across numerous authorities. These bodies operate under different legal mandates, institutional structures, and enforcement priorities, often reflecting distinct regulatory traditions and policy objectives.

Institutional diversity may sometimes be justified by the aims of individual instruments. Yet it also creates challenges for the coherence of the overall regulatory system. The risk extends beyond duplicative administrative efforts. Overlapping jurisdictions and fragmented oversight may produce situations in which obligations imposed by one authority are difficult to reconcile with those enforced by another. Firms may then face conflicting requirements, higher compliance costs, and greater legal uncertainty, undermining both the effectiveness and the credibility of the EU’s digital regulatory framework.

Fragmentation may also arise when new regulatory initiatives pursue objectives already addressed under existing EU or national law. The DMA illustrates this risk. The regulation’s justification for EU-level harmonisation rests on the cross-border nature of digital-platform services, which makes it difficult for individual Member States to address the identified competition concerns effectively. In practice, however, the boundaries between the DMA and traditional competition law—both at EU and national levels—remain uncertain.

Since the adoption of the DMA, several Member States have introduced or expanded national initiatives addressing digital markets. These include new competition-law provisions tailored to digital platforms, rules addressing economic dependence, and expanded market-investigation powers for national authorities. The result is a growing landscape of overlapping regulatory initiatives.

The parallel application of the DMA at the EU level alongside the enforcement of both existing and newly adopted national rules creates risks of double jeopardy, inconsistent enforcement outcomes, and conflicting decisions across jurisdictions.[42] These developments threaten the integrity of the internal market and risk undermining the very rationale for adopting a harmonised EU framework for digital markets.[43]

VI. Competitiveness and EU Digital Regulation

The Fitness Check’s stated purpose is to assess how the EU digital rulebook affects—and supports—the Union’s competitiveness.[44] This is ultimately the most important question. The evidence available to date suggests cause for concern.

In a recent white paper, ICLE scholars examined whether the EU’s Digital Package—comprising the DMA, DSA, Data Act, and AI Act—responds to the needs of technology startups and scaleups.[45] The analysis found considerable heterogeneity. Some instruments attempt to address startup-specific concerns, while others scarcely acknowledge them. All the acts provide some exemptions or carveouts for SMEs, but these differ significantly in scope. The DMA focuses almost exclusively on large gatekeepers, while the AI Act contains more extensive provisions intended to support smaller firms. Despite these carveouts, contradictions across the Digital Package complicate efforts to support SMEs and increase compliance burdens for startups and other firms. These frictions risk harming competition, investment, and innovation.

A central difficulty lies in the fragmented origins of the Digital Package. The instruments were not designed as a single integrated framework. Instead, they emerged at different moments to address distinct perceived problems in digital markets. The result is a regulatory environment that startups encounter as complex and fragmented. Each instrument introduces its own definitions, obligations, and compliance mechanisms. From the perspective of a young firm attempting to launch or scale within the EU, the relevant question is therefore not whether any single rule appears reasonable in isolation but whether the cumulative effect of multiple rules creates barriers to entry or expansion. Scholars of regulatory economics have long observed that such cumulative burdens can be particularly harmful in dynamic sectors where experimentation, rapid iteration, and risk-taking drive innovation.[46]

Empirical evidence from the implementation of the GDPR offers a cautionary precedent. A study by Jian Jia, Ginger Zhe Jin, and Liad Wagman found that, within a year of the GDPR’s enforcement, European technology startups experienced an average reduction of 26.1 per cent in monthly venture-funding deals relative to their U.S. counterparts.[47] The decline persisted through at least 2020. The contraction was most pronounced among data-driven startups, firms aged zero to three years, and business-to-consumer ventures.[48] A separate study found that the GDPR prompted websites to reduce their use of third-party technology vendors, leading to a 15 per cent decline in vendors serving EU visitors and a 17 per cent increase in market concentration among service providers.[49] Larger firms—including Google and Facebook—expanded their market shares at the expense of smaller advertising-technology providers. As Michal Gal and Oshrit Aviv conclude, the GDPR’s privacy safeguards have had the unintended effect of limiting competition and increasing concentration in data-related markets.[50]

These findings highlight a broader structural concern about regulatory design in digital markets. Digital innovation often depends on network effects, access to data, and rapid scaling. Even modest regulatory frictions can therefore produce disproportionate effects on entrepreneurial activity.[51] Venture-capital investment is particularly sensitive to these frictions. Investors routinely assess regulatory risk when deciding where to allocate capital. Jurisdictions perceived as imposing unpredictable or costly compliance obligations tend to attract less early-stage investment. Empirical research suggests that regulatory shocks can influence not only the number of startups created but also where those firms choose to locate their operations.[52] Regulatory policy thus shapes not only the performance of existing firms but also the geographic distribution of future innovation.

These dynamics are likely to recur as additional layers of regulation accumulate. Compliance costs tend to fall disproportionately on smaller firms that lack the diversified data assets, legal teams, and compliance departments that allow large incumbents to absorb new requirements more easily. Higher fixed compliance costs raise barriers to entry, weaken incentives for entrepreneurship, and risk consolidating market power in the very firms that regulation seeks to constrain.

This dynamic creates what might be called a ‘compliance paradox’: regulations designed to constrain large platforms may inadvertently strengthen their competitive position by raising the fixed costs that potential challengers must bear. A two-person startup cannot maintain a compliance department. The fixed costs of understanding and complying with overlapping requirements under the GDPR, AI Act, DSA, and Data Act are substantial, regardless of firm size. These costs divert resources that would otherwise support product development, customer acquisition, and innovation. Surveys of European digital startups confirm that these concerns are widely shared. A recent Stripe survey found that 83 per cent of startups believe EU policymaking is geared toward incumbents and that entrepreneurs want policymakers to prioritise reforms that save them time and money.[53]

Compliance costs also shape firms’ strategic decisions. When regulatory obligations become complex and uncertain, entrepreneurs may avoid entering regulated sectors altogether. Others may redirect their efforts toward jurisdictions with clearer or lighter regulatory frameworks. In digital markets, this dynamic can produce a form of ‘innovation migration’, in which promising firms establish themselves outside the EU to access more favourable investment environments. Multiple factors contribute to this pattern—including capital-market depth and labour mobility—but regulatory complexity frequently appears among the cited drivers.

The Draghi Report reached similar conclusions. It emphasised that scale is crucial for performance, innovation, and competitiveness. The report warned that the EU’s regulatory burden risks preventing European firms from achieving the scale needed to compete globally.[54] Among leading software and internet companies, EU firms account for only 7 per cent of global research-and-development expenditure, compared with 71 per cent for U.S. firms.[55] Between 2008 and 2021, 147 European unicorns were founded, yet 40 later relocated their headquarters abroad—most of them to the United States.[56] These figures point to structural weaknesses in the European innovation ecosystem that regulation may exacerbate, rather than resolve.

The cumulative nature of digital regulation also raises institutional questions about how impact assessments are conducted. EU legislative procedures typically evaluate the expected effects of individual proposals. They rarely examine how multiple regulatory instruments interact once implemented simultaneously. Policymakers may therefore underestimate the real compliance burdens facing firms operating across several regulatory regimes. Each framework introduces its own reporting obligations, governance requirements, and liability risks. The combined effect can exceed the sum of the individual rules.

Impact assessments accompanying key elements of the Digital Package appear not to have fully accounted for these dynamics. ICLE’s analysis suggests that the DMA, Data Act, and AI Act assessments at times overlooked the potential effects of these regulations on startups and on venture-investment incentives.[57] This concern is echoed by France Digitale, the largest startup advocacy organisation in Europe, which has called for regulatory ‘breathing space’ to allow startups to comply with successive regulations. The organisation proposes extended moratorium periods beyond the 12 months currently provided under the DSA and Data Act.[58]

The Fitness Check should therefore evaluate the cumulative compliance burden that the Digital Package imposes on SMEs and startups, rather than examining each instrument in isolation. This evaluation should consider interaction effects across instruments. A startup operating in the health-technology sector, for example, may simultaneously face obligations under the GDPR, the AI Act, the Data Act, the NIS2 Directive, the Medical Devices Regulation, and the forthcoming European Health Data Space Regulation. Each framework introduces its own definitions, reporting requirements, and supervisory authorities. The cumulative burden of this regulatory web may prove qualitatively different—and substantially greater—than the sum of the individual obligations.

The Fitness Check should also examine whether digital regulation creates barriers that prevent firms from scaling, including by constraining exit opportunities. Competitiveness and innovation do not arise solely from startups. Large firms play a central role in modern innovation ecosystems, particularly in research-intensive sectors such as software, artificial intelligence, and digital infrastructure. Empirical research consistently finds that larger firms account for a disproportionate share of global R&D spending and often possess the resources needed to transform early-stage ideas into scalable technologies.[59] Startups frequently depend on these firms as partners, customers, and sources of capital. Acquisition by an established company is a common exit pathway that allows new technologies to be deployed at scale.

Policies that focus exclusively on promoting startups while constraining the firms that provide scale, capital, and commercialisation pathways risk weakening the broader innovation ecosystem. Article 14 of the DMA, which requires gatekeepers to inform the Commission of intended concentrations, has therefore attracted concern among venture investors. Acquisition by large technology companies represents a common and often essential exit strategy for European startups.[60] Empirical research also suggests that acquisitions by large technology firms can stimulate venture-capital activity globally, including in Europe and the United States.[61] If regulatory frameworks make such acquisitions more uncertain or costly, venture investment may shift toward less regulated jurisdictions, with long-term consequences for European innovation.[62]

Given these dynamics, the Fitness Check should also establish a mechanism for continuous evaluation of the cumulative effects of EU digital regulation, rather than treating this exercise as a one-off review. Regulation in fast-moving markets requires continuous learning. If evidence shows that specific rules discourage startup formation, investment, or innovation, policymakers should have the institutional tools needed to adjust thresholds, refine obligations, or introduce targeted exemptions. A standing efficiency-review mechanism—supported by systematic cost-benefit analysis and structured stakeholder consultation—would help ensure that the EU digital rulebook remains fit for purpose as markets and technologies evolve.

VII. Conclusion

The Digital Fitness Check offers the Commission an opportunity to assess the cumulative effects of the EU’s digital rulebook with analytical clarity. Individual instruments within the Digital Package may address legitimate concerns. Taken together, however, they have produced a regulatory architecture characterised by overlapping obligations, inconsistent definitions, fragmented governance, and cumulative compliance costs that risk undermining the objectives these measures were meant to achieve.

Several conclusions follow.

First, the Fitness Check should adopt a methodology capable of capturing indirect effects, interaction effects, and the full economic impact of regulation. Current impact assessments often focus narrowly on direct compliance costs while overlooking ecosystem effects, opportunity costs, and cumulative burdens. The large gap between the Commission’s projected DMA compliance costs and the actual costs reported by designated gatekeepers illustrates this problem. The Commission’s own Regulatory Scrutiny Board identified serious evidentiary shortcomings in the DMA impact assessment before the regulation was adopted. Those findings should serve as a baseline. Substantive amendments introduced after the impact-assessment stage should also trigger supplementary assessments proportionate to their significance.

Second, the Commission should address definitional spillovers across the digital acquis. Concepts such as ‘gatekeeper’ and ‘very large online platform’ increasingly appear outside the instruments for which they were originally designed. The migration of the gatekeeper concept into the Data Act and the potential extension of the VLOP designation illustrate the risks. The Fitness Check should therefore include a cross-instrument audit of key regulatory definitions, a rebuttable presumption against importing regulatory categories without dedicated interaction assessments, and clearer conflict-management rules for overlapping regimes.

Third, overlapping data regulations risk creating an anti-commons dynamic that suppresses socially valuable data use. The interaction between the GDPR and the DMA is particularly illustrative. Article 5(2) DMA permits cross-service data use with user consent, yet the interpretation of consent following Meta Platforms v. Bundeskartellamt—combined with the exclusion of alternative GDPR legal bases—may render that pathway unavailable in practice. The result may be systematic underutilisation of data without corresponding gains in privacy protection, with implications for service development, AI training, and innovation.

Fourth, the institutional framework for enforcement warrants careful scrutiny. Effective enforcement requires supervisory authorities with sufficient resources, technical expertise, and operational independence. Experience under the GDPR suggests that many national authorities remain under-resourced relative to their responsibilities. At the same time, the growing number of EU and national regulators exercising authority over digital markets creates coordination challenges. The parallel application of the DMA alongside expanding national digital-competition initiatives risks fragmented oversight and inconsistent enforcement.

Fifth, the Fitness Check should examine empirically the cumulative regulatory burden facing startups and SMEs. Evidence from the GDPR experience suggests that regulatory shocks can reduce venture investment and increase market concentration. These findings illustrate a compliance paradox: rules designed to constrain large platforms may entrench their position by raising the fixed compliance costs that smaller firms struggle to absorb. Such dynamics can discourage entrepreneurship, reduce venture-capital investment, and limit scaling opportunities for European startups.

The Fitness Check should therefore evaluate the EU digital rulebook as an integrated system rather than as a collection of isolated instruments. Establishing a mechanism for ongoing assessment—supported by systematic cost-benefit analysis and structured stakeholder input—would help ensure that EU digital regulation remains coherent, proportionate, and supportive of innovation and competitiveness. Ensuring that future legislation is grounded in robust evidence, coherent definitions, coordinated governance, and careful assessment of cumulative economic effects will be essential if the EU’s digital rulebook is to support—rather than constrain—innovation and competitiveness.

[1] Eur. Comm’n, Call for Evidence for an Evaluation/Fitness Check: Digital Fitness Check, Ref. Ares(2025)10018469 (19 Nov. 2025), https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/15554-Digital-fitness-check-testing-the-cumulative-impact-of-the-EUs-digital-rules/public-consultation_en [hereinafter Call for Evidence].

[2] Mario Draghi, The Future of European Competitiveness (Rep. to the Eur. Comm’n, 9 Sept. 2024), https://commission.europa.eu/topics/competitiveness/draghi-report_en [hereinafter Draghi Report]; Enrico Letta, Much More Than a Market: Speed, Security, Solidarity (Rep. to the Eur. Council, Apr. 2024), https://www.consilium.europa.eu/media/ny3j24sm/much-more-than-a-market-report-by-enrico-letta.pdf [hereinafter Letta Report]; Eur. Comm’n, A Competitiveness Compass for the EU, COM(2025) 30 final (29 Jan. 2025) [hereinafter Competitiveness Compass].

[3] Draghi Report, pt. A, at 5.

[4] Ursula von der Leyen, President of the Eur. Comm’n, Opening Keynote Speech at the ‘One Year After the Draghi Report’ Conference, Eur. Comm’n (15 Sept. 2025), https://ec.europa.eu/commission/presscorner/detail/en/speech_25_2102 (‘We can move mountains when we have the ambition, the unity and the urgency. It is our choice. So let us make that choice again. For prosperity.’).

[5] Eur. Comm’n, A Simpler and Faster Europe: Communication on Implementation and Simplification, COM(2025) 47 (11 Feb. 2025), https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:52025DC0047.

[6] Call for Evidence, supra note 1.

[7] Mikołaj Barczentewicz & Kristian Stout, ICLE Comments on the European Commission Digital Omnibus, Int’l Ctr. for L. & Econ. (13 Oct. 2025), https://laweconcenter.org/resources/icle-comments-on-the-european-commission-digital-omnibus, § IV.

[8] Eur. Comm’n, Impact Assessment Report on the Proposal for a Regulation of the European Parliament and of the Council on Contestable and Fair Markets in the Digital Sector (Digital Markets Act), SWD(2020) 363 final, § 3.2 (15 Dec. 2020), https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:52020SC0363.

[9] Mikołaj Barczentewicz, The Digital Markets Act as an EU Digital Tax: When Compliance Costs Dwarf Regulatory Estimates, Truth on the Mkt. (8 July 2025), https://truthonthemarket.com/2025/07/08/the-digital-markets-act-as-an-eu-digital-tax-when-compliance-costs-dwarf-regulatory-estimates.

[10] Carl J. Schramm, Costs to U.S. Companies from EU Digital Services Regulation, Comput. & Commc’ns Indus. Ass’n (July 2025), https://ccianet.org/research/reports/costs-to-us-companies-from-eu-digital-services-regulation.

[11] Barczentewicz, supra note 9.

[12] Eur. Comm’n, DMA Impact Assessment, supra note 8, annex 1, § 4 (Consultation of the RSB).

[13] Eur. Comm’n, Regul. Scrutiny Bd., Regulatory Scrutiny Board Opinion on the Proposal for a Regulation of the European Parliament and of the Council on Contestable and Fair Markets in the Digital Sector (Digital Markets Act), SEC(2020) 437 (10 Dec. 2020), at 3.

[14] Id. The RSB also noted that the impact assessment should ‘better distinguish problems relating to size advantages from the monopolisation of data and the imposition of market rules such as exclusive dealing’.

[15] Geoffrey A. Manne, Dirk Auer, Lazar Radić, Selçukhan Ünekbaş, & Mario A. Zúñiga, ICLE Response to First Review of the Digital Markets Act 20–22, Int’l Ctr. for L. & Econ. (24 Sept. 2025), https://laweconcenter.org/resources/icle-response-to-first-review-of-the-digital-markets-act.

[16] Id. at 23.

[17] Draghi Report, pt. B, at 322.

[18] See Barczentewicz & Stout, supra note 7, § II.C.

[19] Peter Alexiadis et al., Coherence versus Fragmentation: Institutional Challenges to EU Digital Markets Regulation, 24 Bus. L. Int’l 233, 235 (2023).

[20] Ireland’s Balance Between Big Tech and Data Privacy, Simmons & Simmons (4 Oct. 2021), https://www.simmons-simmons.com/en/publications/cktn6s3w12h5v0a21q1n0i8l/irelands-balance-between-big-tech-and-data-privacy.

[21] Regulation (EU) 2016/679 of the Eur. Parl. & of the Council of 27 Apr. 2016 on the Protection of Natural Persons with Regard to the Processing of Personal Data and on the Free Movement of Such Data, and Repealing Directive 95/46/EC, 2016 O.J. (L 119) 1 [hereinafter GDPR], arts. 5–6 (establishing principles of lawfulness, purpose limitation, and data minimisation).

[22] Regulation (EU) 2022/1925 of the Eur. Parl. & of the Council of 14 Sept. 2022 on Contestable and Fair Markets in the Digital Sector, 2022 O.J. (L 265) 1 [hereinafter DMA], arts. 2–3.

[23] Eur. Data Prot. Bd. & Eur. Comm’n, Joint Guidelines on the Interplay between the Digital Markets Act and the General Data Protection Regulation (public consultation, 9 Oct.–4 Dec. 2025), https://www.edpb.europa.eu/our-work-tools/documents/public-consultations/2025/joint-guidelines-interplay-between-digital_en.

[24] Mikołaj Barczentewicz, Comments of the International Center for Law & Economics on the Joint EDPB–European Commission Guidelines on the Interplay Between the DMA and GDPR, Int’l Ctr. for L. & Econ. (4 Dec. 2025), https://laweconcenter.org/wp-content/uploads/2025/12/2025.12-GDPR_DMA-consultation.pdf.

[25] DMA, arts. 2–3

[26] Regulation (EU) 2023/2854 of the Eur. Parl. & of the Council of 13 Dec. 2023 on Harmonised Rules on Fair Access to and Use of Data, 2023 O.J. (L 2854) 1 [hereinafter Data Act], art. 5(3).

[27] DMA, art. 6(9).

[28] Regulation (EU) 2022/2065 of the Eur. Parl. & of the Council of 19 Oct. 2022 on a Single Market for Digital Services, 2022 O.J. (L 277) 1 [hereinafter DSA], arts. 33–37.

[29] James M. Buchanan & Yong J. Yoon, Symmetric Tragedies: Commons and Anticommons, 43 J.L. & Econ. 1 (Apr. 2000).

[30] Michael A. Heller, The Tragedy of the Anticommons: Property in the Transition from Marx to Markets, 111 Harv. L. Rev. 621 (1998); see also id. at 1.

[31] Eur. Comm’n & Eur. Data Prot. Bd., Draft Joint Guidelines on the Interplay Between the Digital Markets Act and the General Data Protection Regulation (Oct. 2025) [hereinafter Draft Joint Guidelines].

[32] Id. recitals 6, 10.

[33] Case C-252/21, Meta Platforms Inc. v. Bundeskartellamt, ECLI:EU:C:2023:537 (4 July 2023).

[34] Id.

[35] Draft Joint Guidelines, recitals 41–42.

[36] Id. recital 46.

[37] Id. recital 48.

[38] See, e.g., Data Act, arts. 5–7 (establishing data-portability rules, including specific obligations for gatekeepers).

[39] Regulation (EU) 2024/1689 of the Eur. Parl. & of the Council of 13 June 2024 Laying Down Harmonised Rules on Artificial Intelligence (Artificial Intelligence Act), 2024 O.J. (L 1689) 1 [hereinafter AI Act], arts. 10, 53, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689.

[40] Oberlandesgericht Köln [Higher Reg’l Ct. of Cologne], Judgment of 27 May 2025, Case No. 6 U 140/24; see also Małgorzata Wojtas & Heiner Mecklenburg, Use of Personal Data for AI Training Does Not Violate DMA According to Higher Regional Court of Cologne, PwC Legal (3 June 2025), https://www.pwclegal.de/use-of-personal-data-for-ai-training-does-not-violate-dma-according-to-higher-regional-court-of-cologne.

[41] Konstantina Bania, Fitting the Digital Markets Act in the Existing Legal Framework: The Myth of the ‘Without Prejudice’ Clause, 19 Eur. Competition J. 116 (2023).

[42] See, e.g., Giuseppe Colangelo, Trendy Antitrust for Digital Markets: Are Market Investigations the New Black?, 15 J. Eur. Competition L. & Prac. 289 (2024).

[43] See Giuseppe Colangelo, The European Digital Markets Act and Antitrust Enforcement: A Liaison Dangereuse, 47 Eur. L. Rev. 597 (2022).

[44] Call for Evidence, supra note 1.

[45] Lazar Radic & Dirk Auer, A Europe Fit for the Age of Startups: Rhetoric and Reality in the EU’s Digital Package, Int’l Ctr. for L. & Econ. (1 Aug. 2025), https://laweconcenter.org/resources/a-europe-fit-for-the-age-of-startups-rhetoric-and-reality-in-the-eus-digital-package.

[46] See, e.g., James Broughel, Regulation and Economic Growth: Applying Economic Theory to Public Policy, Mercatus Ctr. (18 May 2017), https://www.mercatus.org/research/books/regulation-and-economic-growth.

[47] Jian Jia, Ginger Zhe Jin & Liad Wagman, The Short-Run Effects of the General Data Protection Regulation on Technology Venture Investment, 40 Mktg. Sci. 661 (2021).

[48] Id. at 670–75; Jian Jia & Liad Wagman, The One-Year Impact of the General Data Protection Regulation (GDPR) on European Ventures, Data Catalyst Inst. (Jan. 2020), https://datacatalyst.org/wp-content/uploads/2020/01/GDPR-report-2020.pdf.

[49] Garrett A. Johnson, Scott K. Shriver & Samuel G. Goldberg, Privacy and Market Concentration: Intended and Unintended Consequences of the GDPR, 69 Mgmt. Sci. 5695 (2023).

[50] Michal S. Gal & Oshrit Aviv, The Competitive Effects of the GDPR, 16 J. Competition L. & Econ. 349, 352 (2020).

[51] Ironically, these same characteristics of digital markets often justify regulation. See, e.g., DMA, recital 2. ICLE scholars have challenged the assumption that digital-platform regulation should mirror telecoms regulation, warning that doing so may foster dependency and dampen innovation. See Eric Fruits, Digital Platforms Aren’t Telecoms and Their Regulations Shouldn’t Rhyme, Truth on the Mkt. (10 Mar. 2025), https://truthonthemarket.com/2025/03/10/digital-platforms-arent-telecoms-and-their-regulations-shouldnt-rhyme (‘regulatory frameworks that force successful companies to subsidise actual and potential competitors rarely generate meaningful innovation. They create dependency, not dynamism.’).

[52] Josh Lerner, Boulevard of Broken Dreams: Why Public Efforts to Boost Entrepreneurship and Venture Capital Have Failed—and What to Do About It (Princeton Univ. Press 2009).

[53] See Radic & Auer, supra note 45 (citing Stripe, The Startup Report: Europe Edition (2024)).

[54] Draghi Report, pt. B, at 12–13.

[55] Draghi Report, pt. B, at 12.

[56] Id. at 36.

[57] Radic & Auer, supra note 45.

[58] France Digitale, EU Startup and Scaleup Strategy: A Roadmap for European Tech Leaders (Mar. 2025), https://media.francedigitale.org/app/uploads/prod/2025/03/14182410/France-Digitale-EU-Startup-and-Scaleup-Strategy-.pdf.

[59] Draghi Report, pt. B, at 30 (‘There is a close link between the size of companies and technology adoption. Evidence from the US shows that adoption rises with firm size for all advanced technologies. Likewise, while in 2023 30 per cent of large businesses in the EU had adopted AI, only 7 per cent of SMEs had done so. Size enables adoption because larger companies can spread the high fixed costs of AI investment over greater revenues, rely on more skilled management to implement organisational changes, and deploy AI more productively using larger data sets.’).

[60] See Radic & Auer, supra note 45 (discussing the impact of DMA art. 14 on acquisition incentives and venture-capital exit strategies); DMA, art. 14.

[61] Tiago S. Prado & Johannes M. Bauer, Big Tech Platform Acquisitions of Start-Ups and Venture Capital Funding for Innovation, 59 Info. Econ. & Pol’y 100973 (2022).

[62] See Draghi Report, pt. B, at 36 (noting that 40 of 147 European unicorns founded between 2008 and 2021 relocated their headquarters abroad, mainly to the United States).

I. Introduction and Summary

Amazon LEO’s extension request raises important questions about how the Federal Communications Commission (FCC) should apply build-out rules in high-capital-expenditure, launch-constrained industries. These comments evaluate the non-geostationary orbit (NGSO) milestone regime from a law & economics perspective, focusing on the real-options structure of spectrum licensing and satellite-deployment investment.

A satellite license functions economically as a real option[1]—the right, but not the obligation, to deploy and bring into service a constellation at a future date. Milestone rules force exercise of that option on a regulatory timeline. In doing so, they reduce the option value that can make speculative license holding attractive.

The option value of a license differs across firms. For a speculator, option value is high because sunk costs are low and flexibility remains high. For a firm that has already made large, irreversible, deployment-specific investments, option value is much lower. As demonstrated sunk investment grows, the firm has already exercised much of the option embedded in the license. The screening rationale for forced exercise correspondingly weakens.

This framework clarifies the economic logic of milestone policy. Milestones can serve as efficient screening tools when they compel exercise of options held by speculative licensees. Rigid forfeiture rules become dynamically inefficient when applied to firms that have already committed substantial irreversible capital, because those investments demonstrate that the option has largely been exercised.

Milestone rules therefore play an important economic role in deterring warehousing. In capital-intensive, launch-constrained low-Earth orbit (LEO) satellite markets, however, rigid interim milestones may not optimally balance anti-warehousing deterrence, dynamic competition, and efficient capital deployment.[2]

II. The Screening Function of Spectrum Milestones

Spectrum milestones aim to separate genuine operators from speculators.[3] The economic logic parallels classic screening and signaling models. Milestones impose costs that fall differently across firms. For firms that intend to deploy, compliance costs are small relative to their planned investment. For speculators, milestone deadlines—combined with ex ante bond requirements—make warehousing costly. The bond, triggered when a licensee misses a milestone, creates the primary financial penalty that deters speculative holding.[4]

This framework draws on foundational insights from information economics. Spectrum licensing creates information asymmetries between regulators and licensees about deployment intentions. Milestones function as a separating mechanism. Like educational credentials or insurance deductibles, they impose costs that induce self-selection between firms that plan to deploy and firms that do not.[5]

The screening rationale assumes that compliance costs remain systematically lower for genuine deployers than for speculators. That assumption holds when milestones require physical deployment or verified capital expenditures.[6] Under some conditions, rigid forfeiture provisions can invert this relationship. External shocks—such as supply-chain disruptions, launch-vehicle shortages, or force majeure events—can raise compliance costs for all licensees regardless of intent. When that occurs, the screening mechanism can lose its separating function.

The Commission designed its milestone framework primarily for terrestrial wireless systems and early geostationary satellite markets. In those contexts, deployment timelines and capital requirements were more predictable. NGSO broadband constellations present different calibration challenges.

Satellite constellation deployment requires massive capital commitments with multi-year lead times and tightly coupled production steps.[7] Unlike terrestrial build-out—where delays in one market do not prevent deployment elsewhere—satellite manufacturing and launch operate as a single integrated production function. A delay in one launch campaign can cascade through the entire deployment schedule in ways that calendar-based milestones cannot easily accommodate.

Economic theory also recognizes that credible commitments can reveal information that reduces the need for regulatory screening.[8] When a licensee makes substantial transaction-specific investments—such as manufacturing satellites, securing launch contracts, and building ground infrastructure—those expenditures function as self-enforcing bonds that align incentives with deployment. Satellite investments are highly asset-specific. Satellites designed for particular orbital configurations have limited alternative uses, face no meaningful secondary market, and degrade on fixed operational timelines. These features make constellation investments strongly sunk in the economic sense, strengthening the self-enforcing commitment to deployment.[9]

This insight draws on Oliver Williamson’s framework of credible commitments and asset specificity.[10] Spectrum-specific sunk costs create path dependence that discourages abandonment.[11] That behavior is precisely what milestone rules aim to prevent. Once a firm commits billions of dollars to satellite manufacturing and launch, the marginal cost of continuing deployment often falls below the sunk cost already incurred. Economic incentives therefore favor completing the system even without regulatory compulsion.

These dynamics create a potential screening paradox. Firms most likely to satisfy milestone requirements are often those whose investment behavior already demonstrates commitment. At the same time, the anti-warehousing rationale weakens precisely where compliance becomes most likely.

Milestones nevertheless serve an additional coordination function. Operators in later processing rounds rely on predictable timelines from earlier-round licensees to design their systems and negotiate interference protections. Milestones calibrated to encourage expeditious deployment can therefore produce ecosystem-wide benefits beyond screening out speculators.

The key policy question is not whether milestones are necessary for committed deployers. The relevant question is whether their timing and enforcement appropriately balance anti-warehousing deterrence against the risk of penalizing firms whose deployment progress is genuine but constrained by factors beyond their control.

III. Real Options and Satellite Deployment Investment

Spectrum licenses embed real-options characteristics for which milestone policy must account.[12] Deploying a satellite constellation requires large-scale, irreversible investment under uncertainty—precisely the conditions in which option value becomes most important.[13]

Milestone rules effectively force licensees to exercise that option on a regulatory timeline.[14] For speculative holders, forced exercise can improve efficiency by preventing strategic delay.[15] For firms already deep into irreversible deployment, rigid milestone timing can force suboptimal capital allocation without providing meaningful screening benefits.

The real-options framework therefore suggests that milestone policy should consider how much option value a licensee has already extinguished through irreversible investment. A firm that has committed billions of dollars to satellite manufacturing, launch contracts, and ground infrastructure has already exercised much of its deployment option. Remaining uncertainty concerns execution timing, rather than deployment intent.

Milestone enforcement also carries broader competitive implications.[16] In nascent NGSO markets, aggressive enforcement that threatens credible deployers with forfeiture can reduce the number of viable competitors.

The emerging LEO broadband market exhibits characteristics of dynamic competition driven by rapid technological innovation. At the same time, it features network effects and substantial barriers to entry.[17] Regulatory policies that inadvertently eliminate credible competitors through rigid milestone enforcement may impose greater consumer harm than the speculative warehousing such rules seek to prevent.

The regulatory-design literature emphasizes the importance of adaptive mechanisms that incorporate new information.[18] Traditional command-and-control milestone regimes assume stable deployment environments. The NGSO sector instead operates in a context of rapid technological change, evolving launch economics, and supply-chain constraints that regulators did not fully anticipate when adopting the current framework.

Progress-contingent approaches can better align with the real-options structure of LEO investment.[19] Rather than focusing solely on point-in-time milestone compliance, regulators can evaluate a licensee’s deployment trajectory. This approach preserves anti-warehousing deterrence while reducing the risk of forfeiting licenses held by firms that demonstrate genuine deployment progress.

IV. Recommendations for NGSO Milestone Policy

The preceding analysis yields four policy recommendations.

1. Preserve milestone screening as an anti-warehousing tool.

The institutional and economic case for deployment obligations remains strong. Without enforceable commitments, applicants may seek authorizations for speculative purposes—such as blocking rivals, increasing bargaining leverage, or warehousing spectrum rights. Those outcomes would leave orbital and spectrum resources idle and delay service to consumers.

2. Reevaluate milestone calibration.

The Commission should assess whether interim milestones remain calibrated to current industry conditions, including satellite-manufacturing cycles, launch-vehicle availability, and upstream capacity constraints. As the economic literature emphasizes, well-designed mechanisms separate high-value from low-value entrants while minimizing wasteful expenditures that do not increase output or innovation.

A progress-contingent bonding regime could better align the screening mechanism with the underlying information problem. Under such a framework, operators would post financial bonds that are released as they achieve verified deployment milestones. The Commission could also consider a graduated milestone structure with more frequent checkpoints and proportional, rather than binary, consequences.

Under this approach, missing a single milestone would not automatically trigger license suspension or revocation. Instead, partial bond forfeiture tied to each checkpoint would maintain continuous incentive pressure while preserving the operator’s ability to demonstrate compliance at later intervals. This structure would address the bluntness of the current two-milestone regime—50% and 90% deployment thresholds—by providing more granular visibility into deployment progress. Any recalibration should also align with the proposed extension of NGSO license terms to 20 years under the Space Modernization for the 21st Century NPRM.

3. Better incorporate evidence of sunk investment.

The Commission’s waiver process allows operators to present sunk-investment evidence when seeking milestone extensions. The absence of clear criteria, however, has produced inconsistent outcomes. In some cases, operators cite aggregate expenditure figures without verifiable benchmarks demonstrating meaningful deployment progress.

The Commission should formalize objective, verifiable metrics—such as completed satellite manufacturing, binding launch contracts, or finished ground infrastructure—as structured criteria for evaluating whether a licensee has effectively exercised its deployment option. These metrics would shift milestones from automatic forfeiture triggers toward rebuttable screening tools.

When operators can credibly demonstrate substantial sunk investment, the marginal benefits of rigid calendar-based deadlines fall, while the marginal costs—including false-positive forfeiture risk and entry barriers—rise. NASA’s commercial-resupply program offers a useful institutional model: staged readiness assessments and technical reviews, rather than binary date-certain forfeiture.

4. Account for dynamic and regulatory competition.

Milestone enforcement sends signals that extend beyond individual licensees. In LEO broadband markets with high fixed costs and strong first-mover dynamics, revoking a near-deployment authorization can reshape market structure. Such actions may weaken potential competition, accelerate market tipping, and redirect investment toward foreign regulatory regimes.[20]

Milestone rules serve an important economic function in allocating scarce orbital and spectrum resources. Their efficiency, however, depends on calibration to industry structure and input constraints. The Commission’s task is not to decide whether milestones should exist. The relevant question is whether enforcement should distinguish between speculative reservation of rights (where option value remains high and screening is most valuable) and demonstrated, irreversible commitment to deployment (where the option has largely been exercised and the screening rationale weakens).

The Commission should evaluate the pending request through a forward-looking, economically informed framework that considers screening accuracy, dynamic investment incentives, global regulatory competition, and the long-run structure of LEO markets. The FCC’s Space Modernization for the 21st Century NPRM recognizes that legacy rules may not reflect contemporary LEO deployment economics.[21] The same recognition should guide the Commission’s approach here.

[1] See Avinash K. Dixit & Robert S. Pindyck, Investment Under Uncertainty (Princeton Univ. Press 1994); Avinash K. Dixit, Entry and Exit Decisions Under Uncertainty, 97 J. Pol. Econ. 620 (1989).

[2] See Peter Cramton, Innovation and Market Design, 9 Innovation Pol’y & Econ. 113 (2009) (analyzing market-design tools that select high-value entrants while minimizing waste).

[3] See George A. Akerlof, The Market for “Lemons”: Quality Uncertainty and the Market Mechanism, 84 Q.J. Econ. 488 (1970); Paul Milgrom & John Roberts, Price and Advertising Signals of Product Quality, 94 J. Pol. Econ. 796 (1986).

[4] See Akerlof, supra note 3; see also Peter Q. Blair & Bobby W. Chung, A Model of Occupational Licensing and Statistical Discrimination, 111 AEA Papers & Proc. 91 (2021).

[5] See Joseph D. Piotroski & Suraj Srinivasan, Regulation and Bonding: The Sarbanes-Oxley Act and the Flow of International Listings, 46 J. Acct. Res. 383 (2008) (finding that high compliance costs screen out smaller firms and drive jurisdictional sorting).

[6] See Blair & Chung, supra note 4; Xing Xia, Barrier to Entry or Signal of Quality? The Effects of Occupational Licensing on Minority Dental Assistants, 71 Labour Econ. (2021).

[7] See Kristian Stout, Satellite-Spectrum Policy Changes Are Needed, Int’l Ctr. for L. & Econ. (2025), https://laweconcenter.org/resources/satellite-spectrum-policy-changes-are-needed; Michael Calabrese, Jessica Dine & Kristian Stout, Ex Parte Letter of ICLE and OTI Re: SB Docket Nos. 25-180, 25-157 & 25-306, Int’l Ctr. for L. & Econ. & New Am. Found. Open Tech. Inst. (2026), https://laweconcenter.org/resources/ex-parte-letter-of-icle-and-oti-re-sb-docket-nos-25-180-25-157-25-306.

[8] See Edward B. Rock, Securities Regulation as Lobster Trap: A Credible Commitment Theory of Mandatory Disclosure, 23 Cardozo L. Rev. 675 (2002).

[9] See Oliver E. Williamson, Credible Commitments: Using Hostages to Support Exchange, 73 Am. Econ. Rev. 519 (1983); Richard Baldwin, Sunk-Cost Hysteresis, Nat’l Bureau of Econ. Rsch., Working Paper No. 2911 (1989).

[10] See Williamson, supra note 9; see also Baldwin, supra note 9.

[11] See Baldwin, supra note 9 (showing that sunk costs create path dependence that discourages exit after deployment).

[12] See Dixit & Pindyck, supra note 1; Lenos Trigeorgis, Real Options and Investment Under Uncertainty: What Do We Know?, Nat’l Bureau of Econ. Rsch., Working Paper No. 22 (2002).

[13] See Dixit, supra note 1; Scott R. Baker, Nicholas Bloom & Steven J. Davis, Measuring Economic Policy Uncertainty, 131 Q.J. Econ. 1593 (2016).

[14] See Nancy L. Stokey, Wait-and-See: Investment Options Under Policy Uncertainty, 21 Rev. Econ. Dynamics 246 (2018).

[15] See Cramton, supra note 2; Stokey, supra note 14.

[16] See Richard J. Gilbert, The Role of Potential Competition in Industrial Organization, 3 J. Econ. Persp. 107 (1989); David S. Evans & Richard Schmalensee, Some Economic Aspects of Antitrust Analysis in Dynamically Competitive Industries (MIT Press 2002).

[17] See Michael Calabrese et al., Low-Earth Orbit Satellites: Policies to Promote Spectrum Sharing, Foster Competition, and Close Digital Divides—A Report of the LEO Policy Working Group, Int’l Ctr. for L. & Econ. & New Am. Found. Open Tech. Inst. (2025), https://laweconcenter.org/resources/low-earth-orbit-satellites-policies-to-promote-spectrum-sharing-foster-competition-and-close-digital-divides-a-report-of-the-leo-policy-working-group.

[18] See Warren E. Walker, Vincent A.W.J. Marchau & Darren Swanson, Addressing Deep Uncertainty Using Adaptive Policies, 77 Tech. Forecasting & Soc. Change 917 (2010).

[19] See generally Ian Ayres & John Braithwaite, Responsive Regulation: Transcending the Deregulation Debate (Oxford Univ. Press 1992); see also Diane S. Koons et al., Risk Mitigation Approach to Commercial Resupply to the International Space Station, Nat’l Aeronautics & Space Admin. (2010), https://ntrs.nasa.gov/api/citations/20100014822/downloads/20100014822.pdf (describing NASA’s staged readiness reviews and milestone-based risk management).

[20] See generally Victor Fleischer, Regulatory Arbitrage, Univ. of Colo. L. Sch. Legal Stud. Res. Paper No. 10-11 (2010), https://papers.ssrn.com/sol3/papers.cfm?abstract_id=1567212; Anthony Van Fossen, Globalization, Stateless Capitalism, and the International Political Economy of Tonga’s Satellite Venture, 22 Pac. Stud. 1 (1999); Steven Vogel, International Games With National Rules: How Regulation Shapes Competition in “Global” Markets, 16 J. Pub. Pol’y 167 (1996).

[21] See Space Modernization for the 21st Century, 90 Fed. Reg. 56,338 (2025) (FCC).

Executive Summary

The International Center for Law & Economics (ICLE) appreciates the opportunity to respond to the National Institute of Standards and Technology’s Request for Information on security considerations for AI agent systems. These comments address Questions 4(d)(ii), 5(b), 5(d), and 5(e), drawing on law & economics research on security investment, comparative regulatory analysis, and insights from fields outside artificial intelligence and cybersecurity.

A central barrier to effective AI agent security monitoring is doctrinal ambiguity across overlapping legal regimes. Privacy and communications laws rarely prohibit monitoring outright. Instead, uncertainty about how monitoring practices will be classified raises the expected cost of observability infrastructure. Firms—particularly smaller deployers—therefore underinvest in telemetry, logging, and anomaly detection. The resulting security blind spots reflect avoidable compliance friction rather than intentional privacy protection.

To reduce this monitoring gap, NIST should prioritize four areas of government collaboration. First, define the technical parameters of security-necessary telemetry, including a taxonomy of telemetry types by privacy sensitivity, purpose-separation design patterns, and retention and access matrices. Second, develop sector-specific monitoring profiles for high-friction deployment contexts such as health care, financial services, education, and workplace systems. Third, promote standards convergence by publishing crosswalks aligning NIST frameworks with international standards such as ISO/IEC 42001 and ISO/IEC 27001. Fourth, support a common AI incident-reporting vocabulary and standardized reporting fields to reduce multi-regime reporting costs.

Comparative analysis shows that no jurisdiction has resolved the tension between monitoring obligations and privacy constraints. The European Union establishes the clearest monitoring mandates but generates regulatory complexity across overlapping instruments. The United Kingdom’s principles-based model offers flexibility but weaker enforcement clarity. China’s sovereignty-centered approach enables decisive regulation but is incompatible with cross-border governance frameworks. Singapore’s standards-led model shows that monitoring gaps can persist even when organizations formally adopt security-management standards.

Insights from other fields reinforce these conclusions. Research on investment under uncertainty shows that regulatory ambiguity depresses security investment. Trade secret law demonstrates how “reasonable measures” standards can guide security practices without prescribing rigid technical rules. Stable definitions of security-necessary monitoring—supported by technical standards, rather than prescriptive mandates—can therefore improve both security outcomes and innovation incentives.

 I. Question 4(d)(ii): Are there legal and/or privacy challenges to monitoring deployment environments for security threats, risks, or vulnerabilities?

A. The Telemetry Paradox

Yes—and the challenges are structural, rather than incidental. A major and underappreciated barrier to effective AI-agent security monitoring is doctrinal ambiguity across overlapping legal regimes. This ambiguity raises the expected cost of monitoring to the point where firms rationally underinvest in the observability that agent security requires.

We refer to this dynamic as the “Telemetry Paradox.” The granular monitoring necessary to secure autonomous agents simultaneously expands regulated data processing and surveillance risk. At the same time, the mismatch between agent architectures and legacy legal categories makes it difficult to identify the compliance boundary ex ante.

The consequences are significant. Legal certainty functions as a principle of economic efficiency because it reduces the transaction costs firms face when planning compliance-sensitive investments. When the legality of monitoring is unclear, firms rationally delay or scale back telemetry—even when known threat vectors remain unaddressed.[1] Emerging evidence suggests that EU regulatory frameworks often become the highest common technical baseline for transatlantic deployments. In practice, the most restrictive classification of monitoring practices can therefore shape global system design.[2]

Two concrete scenarios illustrate the Telemetry Paradox.

A hospital deploying an AI agent to assist with claims processing needs tool-call logs and reasoning traces to detect prompt-injection attacks and billing anomalies. Yet that telemetry can capture protected health information subject to Health Insurance Portability and Accountability Act (HIPAA) minimum-necessary requirements and potentially General Data Protection Regulation (GDPR) special-category restrictions if European patients are involved.

A software-as-a-service (SaaS) provider deploying an agent with tool access across multiple customer environments requires cross-session behavioral baselines to detect privilege escalation and lateral movement. Each customer’s data-processing agreement may impose different retention limits, access controls, and deletion timelines on the same log stream.

In both cases, the monitoring necessary for security is precisely the monitoring that overlapping legal regimes make difficult to scope with confidence.

A further complication is that monitoring infrastructure itself can create privacy and security risks. Research on privacy side channels in machine-learning systems shows that system-level monitoring components—such as query filtering, output monitoring, and preprocessing layers—can be exploited to extract private information at rates significantly higher than attacks against the underlying model.[3] Increased telemetry may therefore reduce certain categories of security loss while simultaneously increasing expected privacy loss. Legal regimes thus have independent reasons to scrutinize broad, undifferentiated monitoring.

B. Legal Sources of Monitoring Uncertainty

Several overlapping legal regimes contribute to what we call the “observability gap.”

1. U.S. communications law

U.S. communications law generally reflects two conceptual approaches: restrictions on acquiring or intercepting data, and regulation of how data may be used once collected. In the long run, the latter provides a more productive lens for evaluating security–privacy tradeoffs in agentic AI deployments.

The Electronic Communications Privacy Act (ECPA) illustrates the problem. Its core distinction between interception of communications in transit (Wiretap Act) and access to communications in storage (Stored Communications Act) maps poorly onto AI-agent traffic. These statutes were designed for discrete messages, not for continuous, replicated data flows.[4]

The Stored Communications Act’s categories—content versus non-content, storage duration thresholds, and provider classifications—fit poorly with agent telemetry. An agent’s tool-call arguments may qualify as “content” under one statutory provision while functioning as system telemetry under another. The individual whose privacy interests are implicated may be a third-party human whose message the agent processes, rather than the deployer operating the system.

Recent class-action litigation alleging that AI-powered transcription and monitoring constitute unlawful interception illustrates the strain these statutes face when applied to agentic systems.[5]

These difficulties suggest that the most productive governance lens is not ECPA’s transit-versus-storage taxonomy, but a purpose-limitation framework grounded in contextual privacy expectations. The central challenge in personalized AI governance is the information asymmetry between developers and users regarding data collection, retention, and repurposing. These conditions produce adverse-selection dynamics analogous to George Akerlof’s “market for lemons.”[6]

Under a purpose-limitation approach, user data should be used only for the purposes for which it was shared. Governance would focus on evaluating system outputs and observable harms rather than prescribing technical architectures or attempting to classify data flows under statutory categories designed for a different technological environment.[7]

Applied to agent-security telemetry, this framework offers several advantages.

First, it accommodates the mixed-purpose nature of monitoring data. Agent telemetry frequently serves security, compliance, and product-improvement functions simultaneously. A purpose-limitation framework can evaluate these uses without forcing artificial classification into “content” and “non-content” categories.

Second, it scales across contexts by calibrating obligations to data sensitivity. Existing sectoral regimes illustrate this approach. The Gramm–Leach–Bliley Act establishes disclosure and opt-out requirements for nonpublic personal information in financial services, while HIPAA imposes strict purpose limitations on protected health information. Both operationalize purpose limitation without imposing a uniform technical classification scheme.[8]

Third, it addresses third-party privacy concerns directly. When an agent processes a third party’s message, the relevant question is whether the processing falls within the purpose for which the data was shared—not whether the data was “in transit” or “in storage” at the moment of access.

The Wiretap Act and Stored Communications Act remain relevant, but primarily as litigation risk rather than as governance frameworks. If courts begin treating agent tool calls as “interceptions,” the resulting precedent could chill legitimate security monitoring while failing to address the underlying privacy harms. Policymakers should therefore consider whether a voluntary certification regime—supported by standardized disclosures and minimal legal backstops under existing consumer-protection authority—could provide a credible alternative governance path.[9]

The Cybersecurity Information Sharing Act of 2015 illustrates the fragility of narrow purpose-specific carve-outs. Its protections for monitoring “for cybersecurity purposes” depend on purpose segmentation that current regulatory guidance does not clearly define. The statute’s repeated short-term renewals further underscore the instability of this approach.[10]

2. EU data protection

The GDPR simultaneously requires security and constrains data collection. Article 32 mandates “appropriate technical and organisational measures,” while Article 5’s minimization and storage-limitation principles restrict the scope and duration of monitoring.[11]

For security telemetry, the most relevant lawful basis is legitimate interest under Article 6(1)(f). The European Data Protection Board’s 2024 guidelines recognize network and information security as a paradigmatic legitimate interest, reflecting Recitals 47 and 49. They also require a documented three-step balancing test and prior assessment.[12]

This framework acknowledges that security monitoring may be lawful but does not provide clear ex ante certainty about which monitoring designs will survive enforcement scrutiny. The resulting uncertainty becomes a central compliance risk.[13]

The economic implications are substantial. James Langenfeld, Frank Fagan, and Samuel Clark show that legal restrictions that create information gaps distort security investment and increase expected harm.[14] Building a security-logging system requires a large upfront investment, while the privacy risk associated with operating it accrues continuously.

When firms cannot predict whether regulators will classify logging as excessive processing, they face an asymmetric payoff structure. Under-monitoring generates diffuse and difficult-to-attribute security losses. Over-monitoring can produce discrete, litigable privacy violations.

The European Data Protection Board’s breach-notification guidance documents incidents in which “data was exfiltrated without leaving a trace in the logs.”[15] These examples illustrate the operational costs of insufficient monitoring that regulators later criticize in post-incident investigations.

3. ePrivacy overlay

Even when GDPR compliance is addressed, the ePrivacy Directive adds another layer of uncertainty. Article 5(3) restricts storing information or gaining access to information on terminal equipment.

The European Data Protection Board’s guidance in internet-of-things (IoT) contexts suggests a broad interpretation that could encompass agent-side instrumentation.[16] Runtime inspection tools—such as SDK instrumentation, endpoint telemetry, and local sandboxes recording tool invocations—may therefore require consent unless they fall within a narrow exemption.

Whether these monitoring tools qualify as “strictly necessary” for security remains unresolved.

C. Security Investment Effects of Legal Uncertainty

The core economic mechanism is straightforward. When firms cannot predict whether a monitoring practice will be considered lawful, they treat legal risk as an additional cost of security investment—and invest less.

The Gordon–Loeb model, developed by Lawrence Gordon and Martin Loeb, formalizes this dynamic. Firms invest in security only up to a bounded fraction of expected loss, with investment most attractive for midrange vulnerabilities.[17] Legal uncertainty alters this calculation by increasing the effective marginal cost of monitoring—through legal review, retention tooling, and litigation reserves—while reducing its perceived effectiveness because firms may hesitate to rely on telemetry during incident response.

Both effects reduce optimal monitoring.

Extensions of the Gordon–Loeb framework further show that, even when accounting for security externalities, socially optimal cybersecurity investment rarely exceeds 37% of expected externality losses.[18] Modest regulatory ambiguity can therefore eliminate a substantial share of socially beneficial monitoring.

The distributional effects resemble patterns observed in other compliance-intensive regulatory settings. Large platform providers can absorb compliance costs and convert monitoring capabilities into competitive advantages. Smaller deployers face the option-value logic of uncertainty and delay or limit monitoring investments.

Empirical research on GDPR compliance costs suggests similar outcomes. One NBER study finds that the GDPR induced the exit of roughly one-third of Google Play apps,[19] while other work finds increased concentration in web-technology markets.[20] Analogous pressures likely affect AI deployments facing uncertain monitoring obligations.

The likely result is a security architecture in which AI-agent risk concentrates among smaller deployers with the least monitoring capacity.

D. FTC Enforcement and Monitoring Obligations

U.S. enforcement practice creates a distinct form of bidirectional uncertainty.

The Federal Trade Commission’s (FTC) action against Rite Aid established that deploying AI-based surveillance technology without “reasonable safeguards” can violate Section 5 of the FTC Act.[21] This sets a floor for monitoring obligations.

At the same time, the FTC’s order in the Drizly matter imposed company-wide data-minimization requirements and mandated deletion of data that no longer served legitimate business purposes.[22] This order signals that retaining large volumes of security-relevant data may itself trigger enforcement risk.

Firms therefore face liability both for insufficient monitoring and for excessive retention. The boundary between the two remains defined largely through case-by-case adjudication.

E. Compound Compliance Frictions in Complex Deployments

These challenges compound in complex regulatory environments.

Consider an AI agent deployed by a financial institution to assist employees in processing customer health-insurance claims. Workplace-surveillance law may constrain the granularity of employee telemetry. The CNIL’s €32 million sanction against Amazon France Logistique—later partially reduced by the Conseil d’État—demonstrates that even operational or security rationales may fail proportionality review.[23]

HIPAA and the Gramm–Leach–Bliley Act simultaneously require logging while imposing distinct retention, access, and disclosure obligations on the same data.

Third-party interactions may incidentally expose trade secrets. The Defend Trade Secrets Act conditions protection on maintaining “reasonable measures” to preserve secrecy—measures that often require monitoring.[24] Yet monitoring itself may constitute unauthorized acquisition of confidential information belonging to third parties.

Each additional legal constraint increases the option value of delaying monitoring investment. The joint probability of compliance failure across multiple regimes rises faster than the sum of individual risks.

In practice, monitoring investments may therefore concentrate on legally mandated requirements—such as HIPAA audit logs or GLBA security-event records—rather than on the most security-relevant observability signals. Agent reasoning traces, anomalous tool-use patterns, and cross-session behavioral baselines may remain unrecorded because no specific mandate requires them and multiple legal regimes create risk from collecting them.

F. Separating Privacy Protection from Compliance Costs

Not all monitoring constraints reduce welfare. Privacy and security address distinct policy objectives. Treating both as access-control problems can produce policy errors in both directions.[25]

The relevant question is not whether legal constraints impose costs—they do—but whether those costs correspond to meaningful privacy protections.

A security-focused telemetry constraint generates avoidable compliance friction when:

1. the restricted telemetry is primarily used for breach detection or forensic attribution, rather than behavioral profiling;
2. the telemetry is less intrusive than content capture, access-controlled, retention-bounded, and insulated from secondary uses; and
3. the privacy risk from retention is low because the recorded events are low-specificity security signals, such as tool-call metadata, authentication tokens, or error codes.

Conversely, a constraint may represent a genuine privacy protection when it restricts telemetry that is substantially more revealing than necessary for security or prevents the repurposing of security data for unrelated functions such as employee performance monitoring.

Several categories of legal constraint clearly provide meaningful protection and should be preserved. Restrictions on generalized interception help prevent mass surveillance of communications content. Authentication requirements for subject-access requests protect individuals from unauthorized disclosure.

Other rules appear to impose compliance costs without comparable privacy benefits. These include the Stored Communications Act’s storage-duration thresholds, the lack of clear standards for “strictly necessary” security logging under the GDPR legitimate-interest framework, and conflicting retention or erasure requirements across sectoral mandates.

The NIST Privacy Framework provides a useful analytical basis for evaluating these tradeoffs. Under this approach, privacy risk arises when data processing creates “problems for individuals,” not merely when it triggers a statutory category.[26]

II. Question 5(b): In which policy or practice areas is government collaboration with the AI ecosystem most urgent?

The Telemetry Paradox described above reflects a coordination problem, rather than a purely technical limitation. AI agent security depends on monitoring architectures that cut across multiple regulatory regimes, standards frameworks, and sectoral obligations. When these regimes use inconsistent terminology or impose conflicting requirements on telemetry collection and retention, the result is underinvestment in the observability necessary for secure deployment. Targeted government coordination—particularly through standards development and shared technical definitions—can reduce this friction without weakening privacy protections. Four areas of collaboration would most directly improve AI agent security.

A. Defining Security-Necessary Telemetry

NIST is well positioned to define the technical parameters of security-necessary telemetry. Establishing a shared technical vocabulary and clear design patterns would make regulatory safe harbors more administrable.

NIST should publish a taxonomy of telemetry types organized by privacy sensitivity. Such a taxonomy could distinguish, for example, tool-call metadata, authentication events, error signals, and anomaly indicators from behavioral-profiling data. It should also include purpose-separation design patterns and sample retention and access matrices.

These definitions could inform regulatory safe harbors used by other agencies—including the FTC, HHS, and even the European Data Protection Board—by establishing a common technical baseline for distinguishing “security-necessary” telemetry from surveillance-oriented monitoring. The evaluative criterion described in Section I.F provides a principled starting point for scoping these definitions.

B. Sector-Specific Monitoring Profiles

Certain deployment contexts create particularly complex monitoring obligations. Health care, financial services, education, and workplace deployments each involve multiple legal regimes that impose overlapping—and sometimes conflicting—requirements on the same telemetry.

NIST should develop sector-specific monitoring profiles for these high-friction environments. This approach would extend the model used in NIST IR 8596 (Cybersecurity Framework Profile for AI) and the HIPAA Security Rule implementation guidance (SP 800-66r2).[27] Sector-specific profiles could specify which monitoring practices are expected, which retention periods are justified, and how conflicts among sectoral mandates should be resolved.

Providing such profiles would help deployers translate high-level regulatory obligations into concrete monitoring architectures.

C. Standards Convergence for Agent Security

AI agent security currently spans multiple overlapping standards frameworks. NIST’s AI Risk Management Framework,[28] the Cybersecurity Framework, the Generative AI Profile,[29] and the emerging agent identity and authorization concept paper[30] should therefore be explicitly bridged to ISO/IEC 42001 (AI management systems) and ISO/IEC 27001 (information security management).

NIST can accomplish this through published crosswalk documents and gap analyses. Existing research mapping ISO 27001 controls against data-protection requirements shows that security compliance and privacy compliance only partially overlap—particularly in areas such as security log retention and access.[31]

NIST-led crosswalks among the AI RMF, the Cybersecurity Framework, the Privacy Framework, and international standards would provide firms with a unified compliance architecture. Without such coordination, organizations must conduct bespoke analyses across multiple standards bodies and jurisdictions.

D. Harmonized AI Incident-Reporting Standards

Incident-reporting requirements for AI systems are emerging across multiple international initiatives. The OECD’s work toward a common AI incident-reporting framework[32] and the G7 Hiroshima AI Process[33] both aim to establish harmonized terminology and reporting criteria.

NIST should actively participate in these initiatives and adopt compatible vocabulary. It should also publish concrete incident-reporting field definitions tailored to AI-agent contexts. Clear reporting schemas would reduce the transaction costs of multi-regime compliance by clarifying which events must be detected, recorded, and reported.

The European Union Agency for Cybersecurity’s (ENISA) multilayer framework for cybersecurity practices in AI provides a useful template. ENISA proposes a three-layer structure consisting of cybersecurity foundations, AI-specific cybersecurity controls, and sector-specific requirements[34] This layered model mirrors the compliance architecture organizations already face in practice and could serve as a basis for coordinated NIST-ENISA work on AI agent security standards.

III. Question 5(d): How are other countries addressing these challenges and what are the benefits and drawbacks of their approaches?

Other major jurisdictions are approaching AI agent security monitoring through distinct regulatory architectures. These frameworks vary in how they define monitoring obligations, allocate enforcement authority, and reconcile security observability with privacy and data-governance constraints. Comparative analysis therefore helps identify which governance strategies reduce monitoring uncertainty and which create additional compliance friction. The following overview highlights several leading models and the tradeoffs they present.

A systematic institutional study of overlaps across the EU digital regulatory ecosystem finds that each regulation “functions reasonably in isolation” but together form an “extremely difficult to navigate” legal landscape.[35] Transparency, logging, and reporting obligations appear repeatedly across multiple instruments, meaning monitoring architectures cannot realistically be designed once—even within the EU—let alone across jurisdictions.

A. European Union: Mandatory Monitoring and Regulatory Complexity

The EU most clearly embeds monitoring obligations directly into AI governance.

The AI Act requires high-risk AI systems to support security observability across the system lifecycle. Article 12 requires systems to enable automatic event logging for traceability and compliance.[36] Article 26 imposes deployer-side log-retention obligations of at least six months, subject to data-protection law.[37] Together these provisions create a credible monitoring baseline supported by conformity assessment.[38]

This structure also creates an important friction point. Article 26’s retention mandate is explicitly conditional on EU or national data-protection law. The Act therefore simultaneously requires log retention and places limits on the legal conditions under which those logs may be retained.

Parallel EU cybersecurity legislation further strengthens the monitoring floor. The NIS2 Directive,[39] the Cyber Resilience Act (CRA),[40] and the Digital Operational Resilience Act (DORA)[41] impose incident and vulnerability reporting obligations, including early-warning and full-notification timelines of 24 hours and 72 hours.[42] These instruments collectively reinforce monitoring requirements across sectors.

The drawback is regulatory complexity. Studies of the EU digital regulatory ecosystem identify conflicts in definitions, reporting timelines, and compliance triggers across at least five overlapping instruments.[43] These inconsistencies create regulatory incoherence. Firms often respond by routinizing minimum compliance rather than optimizing security observability.

B. United Kingdom: Principles-Based Governance and Standards Development

The United Kingdom takes a different approach, relying primarily on principles-based governance implemented by sector regulators.

This model produces fewer AI-specific statutory mandates but also fewer built-in compliance safe harbors. The UK Code of Practice for the Cyber Security of AI sets out expectations that system operators log system actions and analyze logs for anomalies.[44] The government has submitted the Code to ETSI for potential international standardization, reflecting a strategy of shaping global standards rather than imposing detailed domestic rules.

The UK AI Security Institute further supports this approach through evaluation programs. These include agentic task environments and cyber range testing designed to identify the monitoring capabilities necessary for secure AI operation.[45]

One advantage of this model is reduced legal friction for security monitoring. The Data (Use and Access) Act 2025 introduces “recognized legitimate interests” for crime prevention and safeguarding.[46] These provisions reduce the balancing-test burden for security-oriented data processing.

The drawback is enforcement uncertainty. Monitoring expectations ultimately depend on the willingness and capacity of sector regulators to interpret and enforce the principles. Critics therefore describe the model as a form of “regulatory hallucination”—an appearance of governance without binding regulatory obligations.[47]

C. China: Security-Driven and Sovereignty-Centered Regulation

China’s governance architecture links personal-information regulation with national-security objectives in ways that differ significantly from EU and UK approaches.

Rogier Creemers describes China’s Personal Information Protection Law (PIPL) as having a “clear family resemblance” to the GDPR for firm-to-consumer data governance.[48] At the same time, the Data Security Law (DSL) operates as a national-security instrument that places few meaningful constraints on state access to data.

Matt Sheehan’s analysis of China’s AI regulatory process identifies a pattern of deliberate regulatory ambiguity that expands enforcement discretion.[49] This design enables rapid policy implementation and centralized enforcement.

The advantage of this system is decisiveness. The Chinese regulatory framework can quickly establish mandatory monitoring practices and enforce them through administrative action.

The disadvantages are substantial for international deployment. Data-localization requirements under PIPL and the DSL create structural conflicts with EU adequacy-based transfer mechanisms. The EU adequacy framework assumes meaningful limits on government access to data—limits the Chinese system does not provide.

D. Singapore and Japan: Governance Through Testing and Evaluation

Singapore and Japan emphasize testing-based governance rather than prescriptive monitoring mandates.

Singapore’s AI Verify framework and broader collaborative governance model translate security goals into practical testing and certification processes.[50] This approach attempts to operationalize monitoring expectations through technical validation rather than statutory requirements.

Empirical evidence nonetheless suggests implementation gaps. An analysis of 27 major Singapore enforcement cases between 2022 and 2024 finds that the most frequently failed ISO/IEC 27001 controls include Control 8.16 (Monitoring Activities) and Control 8.15 (Logging).[51] These findings suggest that organizations often struggle to operationalize monitoring even when formal security-management standards are adopted.

Network-security failures frequently occur alongside logging failures, producing cascading vulnerabilities in monitoring systems.

E. Comparative Tradeoffs Across Governance Models

Three core tradeoffs emerge from this comparison.

1. Legal certainty versus adaptability

The EU establishes the clearest formal monitoring obligations but generates uncertainty at the interfaces between overlapping regulatory instruments. The UK and Singapore frameworks allow faster regulatory adaptation but leave “reasonable security” expectations less clearly specified.

2. Monitoring floors versus innovation costs

ENISA’s annual surveys of NIS Directive cybersecurity investment across EU member states find that incident-reporting mandates correlate with improved detection and response capabilities.[52] At the same time, compliance burdens and fragmented oversight can reduce effectiveness. Smaller operators in particular often allocate disproportionate resources to reporting requirements, rather than to substantive security improvements.

3. Cross-border operability versus data sovereignty

Modern security operations depend on cross-border telemetry flows. Data-localization measures therefore introduce operational costs and security risks. By 2023, more than 100 localization measures existed across roughly 40 countries, complicating centralized monitoring architectures.[53]

F. Toward a Global AI Governance Regime Complex

The emerging trajectory suggests that global AI governance will develop as a regime complex, rather than a unified regulatory system.

Emma Klein and Stewart Patrick argue that AI governance will likely emerge through “multiple institutions within and across several functional areas,” because “the challenges that AI presents are too multifaceted, the relevant actors too varied, and the geopolitical situation too complicated” for a single global authority.[54]

For AI agent monitoring, this implies that harmonization is unlikely. More realistic governance pathways include mutual recognition regimes, shared incident-reporting vocabularies, and convergence among international technical standards.

IV. Question 5(e): Are there practices, norms, or empirical insights from fields outside of artificial intelligence and cybersecurity that might benefit our understanding?

The monitoring challenges described above are not unique to artificial intelligence. Several mature policy domains—including investment economics and trade-secret law—have long addressed analogous problems involving uncertainty, security incentives, and legal standards for reasonable protection. Their analytical frameworks provide useful guidance for designing AI agent monitoring governance.

A. Investment Under Uncertainty and Security Monitoring

The economics literature on investment under uncertainty provides a well-developed framework for understanding why firms delay monitoring investments when legal conditions are unclear.

Real-options models treat investment decisions as choices between immediate action and waiting for additional information. Nicholas Bloom, Stephen Bond, and John Van Reenen show that moving from low to high uncertainty reduces first-year investment responses to demand shocks by roughly half.[55] Kira Fabrizio similarly finds that anticipated regulatory instability dampens investment even when current policy conditions remain favorable.[56]

Mazaher Kianpour and Shahid Raza extend this framework to cybersecurity. Their analysis shows that regulatory volatility induces “wait-and-see” behavior in cybersecurity investment decisions.[57]

The implication for AI monitoring is straightforward. Legal uncertainty regarding the permissibility of security telemetry produces the same investment-chilling effect observed in other regulated sectors. In energy markets, uncertainty about carbon pricing or renewable-energy subsidies delays infrastructure investment. In AI deployment contexts, uncertainty about monitoring legality delays investments in telemetry, logging infrastructure, and anomaly detection.

The policy response suggested by the literature is also similar. Credible and stable regulatory commitments reduce the option value of delay and encourage earlier investment in protective infrastructure.

B. Trade Secret Law and the ‘Reasonable Measures’ Standard

Trade secret law provides a complementary insight into how legal standards can guide security practices without prescribing detailed technical rules.

Under the Defend Trade Secrets Act, firms receive protection only if they implement “reasonable measures” to maintain the secrecy of protected information. Courts and practitioners have spent decades interpreting and operationalizing this standard.

Raj Sachdev’s Reasonable Cybersecurity Measures Framework provides a structured method for evaluating whether specific cybersecurity practices satisfy this legal threshold.[58] The framework offers a vocabulary that could inform discussions of “reasonable” AI security monitoring.

Empirical research also demonstrates the economic effects of clear protection standards. Ivan Png finds that stronger trade-secret protection correlates with roughly 3.1-3.2% higher R&D investment in innovation-intensive industries.[59] Feng Gao, Xue Wang, and Benda Yin show that stronger trade-secret protection enables firms to shift resources away from defensive secrecy measures and toward productive investment.[60]

Monitoring uncertainty therefore has broader implications than security alone. When firms cannot determine whether monitoring practices will be considered lawful, the resulting uncertainty weakens the appropriation incentives that support innovation.

[1] Aurélien Portuese, Orla Gough & Joseph Tanega, The Principle of Legal Certainty as a Principle of Economic Efficiency, 44(1) Eur. J.L. & Econ. 131 (2017), https://doi.org/10.1007/s10657-014-9435-2 (arguing that legal certainty promotes economic efficiency by reducing transaction costs for compliance-sensitive investments); see also Alessandro Acquisti, Curtis Taylor & Liad Wagman, The Economics of Privacy, 54(2) J. Econ. Literature 442 (2016), https://doi.org/10.1257/jel.54.2.442 (surveying the economics of privacy and explaining how regulatory uncertainty shapes privacy-related economic decisions).

[2] Vijay Kanabar & Krassimira Kaloyanova, Securing Generative AI Systems: Threat-Centric Architectures and the Impact of Divergent EU–US Governance Regimes, 6(1) J. Cybersecurity & Privacy 27 (2026), https://doi.org/10.3390/jcp6010027; see generally Anu Bradford, The Brussels Effect: How the European Union Rules the World (2020) (describing how EU regulation can become the de facto global compliance baseline).

[3] Edoardo Debenedetti et al., Privacy Side Channels in Machine Learning Systems, in Proceedings of the 33rd USENIX Security Symposium (2024), https://www.usenix.org/conference/usenixsecurity24/presentation/debenedetti.

[4] Orin S. Kerr, A User’s Guide to the Stored Communications Act, and a Legislator’s Guide to Amending It, 72 Geo. Wash. L. Rev. 1208 (2004); Orin S. Kerr, The Next Generation Communications Privacy Act, 162 U. Pa. L. Rev. 373 (2014) (arguing that ECPA’s foundational categories are obsolete for modern data flows).

[5] William Simpson, Dressing Old Laws in Class Action Suits: Applying Anti-Wiretapping Laws to AI Transcription Services, IAPP; see, e.g., Ambriz v. Google, LLC, No. 3:23-cv-05437-RFL (N.D. Cal. Feb. 10, 2025) (denying motion to dismiss CIPA claims arising from alleged interception and analysis of customer-service calls using Google Cloud Contact Center AI).

[6] Ben Sperry & Kristian Stout, The Trust Constraint on Personalized AI: How Transparency and Adaptive Governance Can Unlock AI Productivity, ICLE Issue Brief 2026-01-09, at 7–9 (arguing that information asymmetries between AI developers and users regarding data collection, retention, and repurposing create adverse-selection dynamics that undermine trust and constrain personalization’s productivity-enhancing potential).

[7] Id. at 11–12 (“The guiding principle . . . should be purpose limitation; user data should be used only for the purposes for which it is shared.”); id. at 9–10 (advocating governance that evaluates system outputs and observable harms rather than prescribing technical architectures).

[8] Id. at 13–14 (describing GLBA’s disclosure and opt-out requirements for nonpublic personal information as a template for generative AI governance); id. at 14 (analogizing HIPAA’s strict purpose limitations on protected health information to the governance needs of AI systems processing sensitive data in regulated domains).

[9] Id. at 15–16 (proposing a federally recognized safe-harbor framework supported by voluntary, independent verification of data-use commitments, with certification focused on whether firms adhere to stated practices regarding data segmentation, purpose limitation, retention, and non-retraining).

[10] See Jared Bomberg, Workplace Monitoring Gets Easier, IAPP (2016) (explaining the Cybersecurity Information Sharing Act of 2015’s information-sharing protections and their limitations for mixed-purpose telemetry). Note: the Cybersecurity Information Sharing Act of 2015’s information-sharing protections expired on September 30, 2025, were temporarily extended through January 30, 2026, and were further extended through September 30, 2026 via the Consolidated Appropriations Act—the resulting short-term renewals themselves illustrate the regulatory instability this comment describes.

[11] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 Apr. 2016 on the Protection of Natural Persons with Regard to the Processing of Personal Data and on the Free Movement of Such Data (General Data Protection Regulation), 2016 O.J. (L 119) 1, https://eur-lex.europa.eu/eli/reg/2016/679/oj; Cédric Burton, Article 32 Security of Processing, in The EU General Data Protection Regulation (GDPR) (2020), https://doi.org/10.1093/oso/9780198826491.003.0068.

[12] Eur. Data Prot. Bd., Guidelines 1/2024 on Processing of Personal Data Based on Article 6(1)(f) GDPR (2024), https://www.edpb.europa.eu/system/files/2024-10/edpb_guidelines_202401_legitimateinterest_en.pdf; see also Eur. Data Prot. Bd., Opinion 28/2024 on Certain Data Protection Aspects Related to the Processing of Personal Data in the Context of AI Models (2024), https://www.edpb.europa.eu/our-work-tools/our-documents/opinion-board-art-64/opinion-282024-certain-data-protection-aspects_en (confirming that legitimate interest may provide a lawful basis for AI-related processing, including cybersecurity uses).

[13] Mikołaj Barczentewicz, The GDPR and GenAI—Part 1: Lawful Bases, How EU Law Influences Tech (2024), https://eutechreg.com/p/the-gdpr-and-genai-part-1-lawful; see also Gianclaudio Malgieri, Can Legitimate Interest Be an Appropriate Lawful Basis for Processing Artificial Intelligence Training Datasets?, Computer L. & Sec. Rev. (2023), https://doi.org/10.1016/j.clsr.2022.105780 (analyzing the use of legitimate interest, rather than consent, as a lawful basis for AI-related processing).

[14] James Langenfeld, Frank Fagan & Samuel Clark, eds., The Law and Economics of Privacy, Personal Data, Artificial Intelligence, and Incomplete Monitoring, Research in L. & Econ., vol. 30 (2022), https://doi.org/10.1108/S0193-5895202230 (developing a framework linking incomplete monitoring under privacy law to security-investment gaps and resulting welfare losses); Ross Anderson & Tyler Moore, The Economics of Information Security, 314 Science 610 (2006), https://doi.org/10.1126/science.1130992 (showing how misaligned incentives and information asymmetries lead to chronic cybersecurity underinvestment).

[15] Eur. Data Prot. Bd., Guidelines 01/2021 on Examples Regarding Personal Data Breach Notification (2021), https://www.edpb.europa.eu/system/files/2022-01/edpb_guidelines_012021_pdbnotification_adopted_en.pdf.

[16] Eur. Data Prot. Bd., Guidelines 2/2023 on Technical Scope of Article 5(3) of the ePrivacy Directive (2024), https://www.edpb.europa.eu/system/files/2024-10/edpb_guidelines_202302_technical_scope_art_53_eprivacydirective_v2_en_0.pdf. The regulatory framework for Article 5(3) remains unsettled. The European Commission withdrew the proposed ePrivacy Regulation in Feb. 2025 and announced plans to integrate certain ePrivacy rules into the GDPR through the Digital Omnibus Package.

[17] Lawrence A. Gordon & Martin P. Loeb, The Economics of Information Security Investment, ACM Transactions on Info. & Sys. Sec. (2002), https://doi.org/10.1145/581271.581274.

[18] Lawrence A. Gordon et al., Externalities and the Magnitude of Cyber Security Underinvestment by Private Sector Firms: A Modification of the Gordon–Loeb Model, J. Info. Sec. (2015), https://doi.org/10.4236/jis.2015.61003; see also Howard Kunreuther & Geoffrey Heal, Interdependent Security, 26(2–3) J. Risk & Uncertainty 231 (2003), https://doi.org/10.1023/A:1024119208153 (providing a game-theoretic explanation for why interdependent security decisions lead to systematic underinvestment).

[19] Rebecca Janßen et al., GDPR and the Lost Generation of Innovative Apps, Nat’l Bureau of Econ. Rsch., Working Paper No. 30028 (2022), https://www.nber.org/papers/w30028 (finding that the GDPR led roughly one-third of apps to exit the market and reduced consumer surplus by an estimated 32%); see also Christian Frey et al., Privacy Regulation and Firm Performance: Estimating the GDPR Effect Globally, Econ. Inquiry (2024), https://doi.org/10.1111/ecin.13219 (finding that the GDPR reduced profits by about 8% on average for firms serving EU markets).

[20] Garrett A. Johnson, Scott K. Shriver & Samuel G. Goldberg, Privacy and Market Concentration: Intended and Unintended Consequences of the GDPR, 69(10) Mgmt. Sci. 5695 (2023), https://doi.org/10.1287/mnsc.2023.4709 (finding that the GDPR increased web-technology market concentration in the short run due to disproportionate fixed compliance costs); Christian Peukert, Stefan Bechtold, Michail Batikas & Tobias Kretschmer, Regulatory Spillovers and Data Governance: Evidence from the GDPR, 41(4) Marketing Sci. (2022), https://doi.org/10.1287/mksc.2021.1347 (corroborating concentration effects and documenting spillovers to non-EU websites).

[21] FTC v. Rite Aid Corp., No. 2:23-cv-05023 (E.D. Pa. 2023), https://www.ftc.gov/legal-library/browse/cases-proceedings/2023190-rite-aid-corporation-ftc-v (alleging that the deployment of AI-based surveillance without reasonable safeguards constitutes an unfair practice under Section 5 of the Federal Trade Commission Act).

[22] Lesley Fair, Data Security Forecast: Drizly with a 100% Chance of Far-Reaching Order Provisions, Fed. Trade Comm’n Bus. Blog (2022), https://www.ftc.gov/business-guidance/blog/2022/10/data-security-forecast-drizly-100-chance-far-reaching-order-provisions (explaining that the Federal Trade Commission’s Drizly order imposed company-wide data-minimization obligations and treated excessive data retention as a data-security risk).

[23] Commission Nationale de l’Informatique et des Libertés (CNIL), Employee Monitoring: CNIL Fined Amazon France Logistique €32 Million (2024), https://www.cnil.fr/en/employee-monitoring-cnil-fined-amazon-france-logistique-eu32-million (describing the CNIL’s €32 million fine against Amazon France Logistique for excessive employee monitoring that violated GDPR proportionality requirements). On Dec. 23, 2025, the Conseil d’État partially revised the decision and reduced the fine to €15 million, holding that the CNIL erred with respect to certain productivity indicators, while rejecting the remainder of Amazon’s challenge.

[24] Raj Sachdev, “Reasonable [Cybersecurity] Measures” for Digital Trade Secrets: Lessons from Marketing, 65 IDEA: J. Franklin Pierce Ctr. for Intell. Prop. 39 (2025), https://scholars.unh.edu/law_facpub/510.

[25] Derek E. Bambauer, Privacy Versus Security, 103 J. Crim. L. & Criminology 667 (2013), https://scholarlycommons.law.northwestern.edu/jclc/vol103/iss3/2; see also Danielle Keats Citron & Daniel J. Solove, Privacy Harms, 102 B.U. L. Rev. 793 (2022), https://scholarship.law.bu.edu/faculty_scholarship/3096 (developing a taxonomy of privacy harms that clarifies the distinction between privacy harms and security harms).

[26] Nat’l Inst. of Standards & Tech., NISTIR 8062: An Introduction to Privacy Engineering and Risk Management in Federal Systems (2017), https://doi.org/10.6028/NIST.IR.8062; Nat’l Inst. of Standards & Tech., NIST Privacy Framework 1.1, NIST CSWP 40 (Initial Pub. Draft 2025), https://doi.org/10.6028/NIST.CSWP.40.ipd (operationalizing the concepts introduced in NISTIR 8062 and adding AI-specific privacy risk-management guidance).

[27] Nat’l Inst. of Standards & Tech., NIST SP 800-66 Rev. 2: Implementing the HIPAA Security Rule (2024), https://doi.org/10.6028/NIST.SP.800-66r2; see also Dep’t of Health & Hum. Servs., HIPAA Security Rule to Strengthen the Cybersecurity of Electronic Protected Health Information, Notice of Proposed Rulemaking, 90 Fed. Reg. 898 (Jan. 6, 2025) (proposing stronger HIPAA Security Rule requirements, including mandatory multifactor authentication and elimination of the “required” versus “addressable” distinction).

[28] Elham Tabassi et al., Artificial Intelligence Risk Management Framework (AI RMF 1.0), Nat’l Inst. of Standards & Tech. (2023), https://doi.org/10.6028/NIST.AI.100-1; Nat’l Inst. of Standards & Tech., NIST AI RMF to ISO/IEC FDIS 42001 Crosswalk (2023), https://airc.nist.gov/docs/NIST_AI_RMF_to_ISO_IEC_42001_Crosswalk.pdf (documenting efforts to align the NIST AI Risk Management Framework with ISO/IEC 42001).

[29] Chloe Autio et al., Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile (2024), https://doi.org/10.6028/NIST.AI.600-1.

Chloe Autio et al., Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile, Nat’l Inst. of Standards & Tech. (2024), https://doi.org/10.6028/NIST.AI.600-1.

[30] Nat’l Inst. of Standards & Tech., Accelerating the Adoption of Software and Artificial Intelligence Agent Identity and Authorization (Concept Paper, Initial Pub. Draft 2026), https://csrc.nist.gov/pubs/other/2026/02/05/accelerating-the-adoption-of-software-and-ai-agent/ipd (part of the broader NIST AI Agent Standards Initiative announced in Feb. 2026).

[31] Vasiliki Diamantopoulou, Aggeliki Tsohou & Maria Karyda, From ISO/IEC 27001:2013 and ISO/IEC 27002:2013 to GDPR Compliance Controls, Info. & Computer Sec. (2020), https://doi.org/10.1108/ics-01-2020-0004; see also Hans Graux et al., Interplay Between the AI Act and the EU Digital Legislative Framework, Eur. Parl. Comm. on Indus., Rsch. & Energy, Study PE 778.575 (2025), https://www.europarl.europa.eu/thinktank/en/document/ECTI_STU(2025)778575 (mapping overlaps and gaps across the EU digital legislative framework, including requirements related to security log retention and access).

[32] Org. for Econ. Co-operation & Dev., Towards a Common Reporting Framework for AI Incidents, OECD Artificial Intelligence Papers No. 34 (2025), https://doi.org/10.1787/f326d4ac-en; Ren Bin Lee Dixon & Heather Frase, AI Incidents: Key Components for a Mandatory Reporting Regime, Ctr. for Sec. & Emerging Tech., Georgetown Univ. (2025), https://cset.georgetown.edu/publication/ai-incidents-key-components-for-a-mandatory-reporting-regime (proposing elements of a mandatory AI-incident reporting regime modeled on aviation, health-care, and cybersecurity reporting systems).

[33] Org. for Econ. Co-operation & Dev., G7 Hiroshima Process on Generative Artificial Intelligence (AI) (2023), https://doi.org/10.1787/bf3c0c60-en; Org. for Econ. Co-operation & Dev., Overview of the OECD Pilot of the Hiroshima Artificial Intelligence Process Reporting Framework (2024), https://www.oecd.org/en/publications/overview-of-the-oecd-pilot-of-the-hiroshima-artificial-intelligence-process-reporting-framework_e41c1fcc-en.html (reporting pilot results that operationalize the Hiroshima Process commitments).

[34] Eur. Union Agency for Cybersecurity (ENISA), Multilayer Framework for Good Cybersecurity Practices for AI (2023), https://www.enisa.europa.eu/publications/multilayer-framework-for-good-cybersecurity-practices-for-ai.

[35] Graux et al., supra note 32.

[36] Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 Laying Down Harmonised Rules on Artificial Intelligence (Artificial Intelligence Act), arts. 12–13, 2024 O.J. (L 1689) 1, https://eur-lex.europa.eu/eli/reg/2024/1689/oj (requiring high-risk AI systems to enable automatic event logging to support traceability and regulatory compliance).

[37] Regulation (EU) 2024/1689, art. 26 (requiring deployers of high-risk AI systems to retain system logs for at least six months).

[38] Id.; Michèle Finck, Chapter III: High-Risk AI System, in The EU Artificial Intelligence Act (2026), https://doi.org/10.1093/law/9780198925705.003.0004.

[39] Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 Dec. 2022 on Measures for a High Common Level of Cybersecurity Across the Union (NIS 2 Directive), 2022 O.J. (L 333) 80, https://eur-lex.europa.eu/eli/dir/2022/2555/oj; Eur. Union Agency for Cybersecurity (ENISA), Technical Implementation Guidance on Cybersecurity Risk Management Measures (2025), https://www.enisa.europa.eu/sites/default/files/2025-06/ENISA_Technical_implementation_guidance_on_cybersecurity_risk_management_measures_version_1.0.pdf.

[40] Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 Oct. 2024 on Horizontal Cybersecurity Requirements for Products with Digital Elements (Cyber Resilience Act), 2024 O.J. (L 2847) 1, https://eur-lex.europa.eu/eli/reg/2024/2847/oj; Pier Giorgio Chiara, The Cyber Resilience Act: The EU Commission’s Proposal for a Horizontal Regulation on Cybersecurity for Products with Digital Elements, Int’l Cybersecurity L. Rev. (2022), https://doi.org/10.1365/s43439-022-00067-6; Florian Teichmann, The Cyber Resilience Act as a New Paradigm for Product Security: A Compliance Roadmap, Int’l Cybersecurity L. Rev. (2025), https://doi.org/10.1365/s43439-025-00162-4 (analyzing the final enacted regulation).

[41] Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 Dec. 2022 on Digital Operational Resilience for the Financial Sector (DORA), 2022 O.J. (L 333) 1, https://eur-lex.europa.eu/eli/reg/2022/2554/oj; Eur. Supervisory Auths. (EBA, EIOPA & ESMA), Joint Regulatory Technical Standards on Major Incident Reporting Under DORA (2024), https://www.eba.europa.eu/activities/single-rulebook/regulatory-activities/operational-resilience/joint-technical-standards-major-incident-reporting.

[42] G7 Cyber Expert Group, Statement on Artificial Intelligence and Cybersecurity (2025), https://www.gov.uk/government/publications/g7-cyber-expert-group-statement-on-ai-and-cybersecurity/g7-cyber-expert-group-statement-on-artificial-intelligence-and-cybersecurity-september-2025; Jukka Ruohonen & Paul Timmers, Vulnerability Coordination Under the Cyber Resilience Act, Applied Cybersecurity & Internet Governance (2025), https://doi.org/10.60097/acig/213350.

[43] Anacleto Correia & António Gonçalves, Regulatory Convergence and Divergence: A Study on the Synergies and Conflicts Among Key Cybersecurity European Legislation, in MCIS 2024 Proceedings (2024), https://aisel.aisnet.org/mcis2024/4 (identifying conflicts in definitions and reporting timelines across the GDPR, NIS2, DORA, AI Act, and Cyber Resilience Act); Lee A. Bygrave, The Emergence of EU Cybersecurity Law: A Tale of Lemons, Angst, Turf, Surf and Grey Boxes, Computer L. & Sec. Rev. (2024), https://doi.org/10.1016/j.clsr.2024.106071 (describing EU cybersecurity law as “a sprawling jungle of regulatory instruments interacting in complex, confusing and sometimes disjointed ways”).

[44] U.K. Dep’t for Sci., Innovation & Tech., Code of Practice for the Cyber Security of AI (2025), https://www.gov.uk/government/publications/ai-cyber-security-code-of-practice/code-of-practice-for-the-cyber-security-of-ai.

[45] U.K. AI Sec. Inst., Frontier AI Trends Report (2025), https://www.aisi.gov.uk/frontier-ai-trends-report (evaluating frontier AI cybersecurity capabilities, including agentic cyber-task performance across varying levels of difficulty).

[46] Data (Use and Access) Act 2025; U.K. Dep’t for Sci., Innovation & Tech., Data (Use and Access) Act Factsheet: UK GDPR and DPA (2025), https://www.gov.uk/government/publications/data-use-and-access-act-2025-factsheets/data-use-and-access-act-factsheet-uk-gdpr-and-dpa.

[47] Albert Sanchez-Graells, Responsibly Buying Artificial Intelligence: A “Regulatory Hallucination”, 77(1) Current Legal Probs. 81 (2024), https://doi.org/10.1093/clp/cuae006 (coining the concept of a “regulatory hallucination”); Christopher T. Marsden, Generative AI Regulation in the UK, in The Oxford Handbook of the Foundations and Regulation of Generative AI (2025), https://doi.org/10.1093/oxfordhb/9780198940272.013.0043.

[48] Rogier Creemers, China’s Emerging Data Protection Framework, J. Cybersecurity (2022), https://doi.org/10.1093/cybsec/tyac011.

[49] Matt Sheehan, Tracing the Roots of China’s AI Regulations, Carnegie Endowment for Int’l Peace (2024), https://carnegieendowment.org/research/2024/02/tracing-the-roots-of-chinas-ai-regulations?lang=en; Yue Zhu et al., China’s Emerging Regulation Toward an Open Future for AI, 390 Science 132 (2025) (providing an overview of China’s six-pillar AI regulatory architecture).

[50] Sun Sun Lim & Gerry Chng, Verifying AI: Will Singapore’s Experiment with AI Governance Set the Benchmark?, Communication Rsch. & Prac. (2024), https://doi.org/10.1080/22041451.2024.2346416; Infocomm Media Dev. Auth. (IMDA), Model AI Governance Framework for Generative AI (2024), https://www.imda.gov.sg/resources/press-releases-factsheets-and-speeches/archived/imda/press-releases/2024/launch-of-generative-ai-governance-framework.

[51] Jeremy Leonard Naramuda et al., Analyzing the Implementation Gaps in ISO/IEC 27001:2022 Controls: Insights from PDPC Singapore’s Cybersecurity Breaches, in 2025 IEEE 2nd International Conference on Cryptography, Informatics, and Cybersecurity (ICOCICS) (2025), https://www.semanticscholar.org/paper/67f45a88a7de5c19bdea5821610eda816d1f79f7.

[52] Eur. Union Agency for Cybersecurity (ENISA), NIS Investments 2024 (2024), https://www.enisa.europa.eu/publications/nis-investments-2024 (surveying cybersecurity investment and compliance across EU member states under NIS Directive reporting requirements).

[53] Cristina Del Giovane, Janos Ferencz & Javier López González, The Nature, Evolution and Potential Implications of Data Localisation Measures (OECD 2023), https://www.oecd.org/en/publications/the-nature-evolution-and-potential-implications-of-data-localisation-measures_179f718a-en.html; Peter Swire et al., Risks to Cybersecurity from Data Localization, Organized by Techniques, Tactics and Procedures, J. Cyber Pol’y (2024), https://doi.org/10.1080/23738871.2024.2384724 (finding that 13 of 14 ISO 27002 security controls are negatively affected by data-localization requirements).

[54] Emma Klein & Stewart Patrick, Envisioning a Global Regime Complex to Govern Artificial Intelligence, Carnegie Endowment for Int’l Peace (2024), https://carnegieendowment.org/research/2024/03/envisioning-a-global-regime-complex-to-govern-artificial-intelligence?lang=en; Huw Roberts et al., Global AI Governance: Barriers and Pathways Forward, 100(3) Int’l Affs. 1275 (2024), https://doi.org/10.1093/ia/iiae073 (mapping the emerging global AI-governance regime complex).

[55] Nick Bloom, Stephen Bond & John Van Reenen, Uncertainty and Investment Dynamics, Rev. Econ. Stud. (2007), https://doi.org/10.1111/j.1467-937X.2007.00426.x; see generally Avinash K. Dixit & Robert S. Pindyck, Investment Under Uncertainty (1994) (providing the foundational theoretical treatment of real-options investment decisions under uncertainty).

[56] Kira R. Fabrizio, The Effect of Regulatory Uncertainty on Investment: Evidence from Renewable Energy Generation, J.L. Econ. & Org. (2013), https://doi.org/10.1093/jleo/ews007; Scott R. Baker, Nick Bloom & Steven J. Davis, Measuring Economic Policy Uncertainty, 131(4) Q.J. Econ. 1593 (2016), https://doi.org/10.1093/qje/qjw024 (showing that policy uncertainty predicts declines in investment, output, and employment across 12 major economies).

[57] Mazaher Kianpour & Shahid Raza, More Than Malware: Unmasking the Hidden Risk of Cybersecurity Regulations, Int’l Cybersecurity L. Rev. (2024), https://doi.org/10.1365/s43439-024-00111-7.

[58] Sachdev, supra note 24.

[59] Ivan Png, Law and Innovation: Evidence from State Trade Secrets Laws, 99(1) Rev. Econ. & Stat. 167 (2017), https://doi.org/10.1162/rest_a_00532; Colleen Cunningham & Aldona Kapacinskaite, Keeping Invention Confidential, Mgmt. Sci. (2025), https://doi.org/10.1287/mnsc.2023.01434 (finding that stronger trade-secret protection increases both the use and novelty of trade secrets).

[60] Feng Gao, Xue Wang & Benda Yin, The Benefits of Trade Secret Legal Protection: Evidence from Firms’ Cost Structure Decisions, J.L. Econ. & Org. (2022), https://doi.org/10.1093/jleo/ewac013.

Interest and Independence of Amicus Curiae

The amici are present or former academics and former government enforcers. The  Appendix lists their names and affiliations. The amici share an interest in the development of antitrust law and the proper application of summary judgment principles in Sherman Act conspiracy cases. All parties consented to the filing of this brief. No party’s counsel authored any part of the brief, and only the amici and their counsel contributed funds for the preparation or submission of the brief.

Introduction

“The dizzying increase in fuel prices associated with the OPEC oil embargo of 1973 had a severe impact on the trucking industry.” Cent. Forwarding, Inc. v. ICC, 698 F.2d 1266, 1268 (5th Cir. 1983). The Interstate Commerce Commission (ICC), which regulated the industry, responded with rate increases, and when oil prices spiked much higher in 1979, the ICC responded with fuel surcharges. See id. at 1268–69.

Defendants adopted fuel surcharges (hereinafter, FSCs) in 2000. Trucks and trains use the same fuel, but trains are more efficient. Appellants observe that “everything changed in 2003.” Brief for Plaintiffs-Appellants (Pl. Br.) 1. Indeed, the “most remarkable surge in the price of oil since 1979 occurred between mid-2003 and mid-2008 with the WTI [West Texas Intermediate crude] price climbing from $28 to $134 per barrel.” Christiane Baumeister & Lutz Kilian, Forty Years of Oil Price Fluctuations: Why the Price of Oil May Still Surprise Us, J. Econ. Persps., Winter 2016, at 139, 147. The underlying data was before the district court. Dep’t of Energy, Energy Info. Admin., Cushing, OK WTI Spot Price, www.eia.gov/dnav/pet/hist/RWTCD.htm.

Plaintiffs alleged a conspiracy among Defendants relating to their use of FSCs, and they argue that the conspiracy can be inferred from circumstantial evidence. But Defendants had to act as fuel prices rose, and the obvious action was aggressive use of escalators tied to the price of oil—their FSCs. As the district court concluded, Defendants did not act simultaneously or in remarkably similar ways, and their actions were consistent with the pursuit of independent self-interest.

Appellants argue that Defendants’ use of FSCs in 2003 was “nothing like” what came before, and that this alone raises “a triable question about concerted action.” Pl. Br. 50–51. But fuel price increases beginning in 2003 were “nothing like” what came before. The necessity of decisive action and the rationality of the action taken amply support the district court’s conclusion that the evidence did not tend to exclude the possibility that Defendants acted independently.

Summary of Argument

1. The district court faithfully applied precedent demanding evidence from which a reasonable jury could find the inference of a conspiracy more attractive than the alternative inference of independent action. The court determined that a reasonable jury could not infer that Defendants conspired.

Erratic and rapidly rising fuel prices provided “a strong basis for the inference of independent action.” Op. 77. Consequently, a reasonable jury could not infer conspiracy from some similarities in Defendants’ FSCs and some conversations between pairs of Defendants touching on FSCs. Conspiracy can be inferred from marketplace conduct only with actions contrary to independent self-interest. Plaintiffs did not show that anything about Defendants’ FSCs was contrary to their independent self-interest.

2. The district court did not grant summary judgment because of an absence of unusual parallelism. The court concluded that the nature and extent of parallelism did not itself support the inference of conspiracy, and then went on to meticulously examine Plaintiffs’ other evidence and argument, and the record as a whole.

The district court did not explain Defendants’ FSCs as “mere interdependent” conduct, but rather as rational independent action.

The district court did not ignore “plus factors,” but rather required evidence that tends to exclude the possibility of independent action. Ticking a few “plus factor” boxes does not assure that a reasonable jury could find the inference of a conspiracy more attractive than the alternative inference of independent action.

Argument

I. The District Court Correctly Applied the Proper Summary Judgment Standard

Plaintiffs alleged that Defendants engaged into a conspiracy relating to

their FSCs, in violation of Section 1 of the Sherman Act. After many years of litigation, the district court granted Defendants’ motion for summary judgment. Appellants submit that the court departed from “bedrock summary-judgment principles,” Pl. Br. 30, but Appellants misstate those principles and mischaracterize the district court’s ruling.

A. The District Court Applied the Proper Standard

Appellants fault the district court for demanding that Plaintiffs’ evidence “make the inference of a conspiracy more ‘attractive’ than the alternative inference of independent action.” Pl. Br. 30–31, quoting Op. 35. But this articulation of the summary judgment standard is fully consonant with bedrock principles articulated by the Supreme Court.

In Matsushita, the Supreme Court held that “conduct as consistent with permissible competition as with illegal conspiracy does not, standing alone, support an inference of antitrust conspiracy. To survive a motion for summary judgment or for a directed verdict, a plaintiff seeking damages for a violation of § 1 must present evidence that tends to exclude the possibility that the alleged conspirators acted independently.” Matsushita Elect. Indus. Co. v. Zenith Radio Corp., 475 U.S. 574, 588 (1986) (citations and internal quotation marks omitted).

In Twombly the Supreme Court reiterated that, at “the summary judgment stage a § 1 plaintiff ’s offer of conspiracy evidence must tend to rule out the possibility that the defendants were acting independently.” Bell Atl. Corp. v. Twombly, 550 U.S. 544, 554 (2007).

The district court accurately articulated the standard of Matsushita and Twombly. Op. 34–37. Among other things, the court observed that “Matsushita simply demands that the nonmoving party’s inferences be reasonable in order to reach a jury, in light of the alternative inferences and economic realities.” Op. 36, see Matsushita, 475 U.S. at 588.

For guidance on which inferences are reasonable, the district court referred to a pre-Matsushita decision by this Court requiring that “plaintiffs’ evidence must make the inference of a conspiracy more ‘attractive’ than the alternative inference of independent action.” Op. 35, citing Fed. Prescription Serv., Inc. v. Am. Pharm. Ass’n, 663 F.2d 253, 267 (D.C. Cir. 1981) (“inference of conspiracy . . . is warranted only when a theory of rational, independent action is less attractive than that of concerted action”).

In that case, this Court rejected the trial court’s conspiracy finding. The Court held that the trial court clearly erred in finding a conspiracy on the basis of parallel conduct that was not a kind that “could only make sense in the context of ” a conspiracy, but rather could “be persuasively explained by the exercise of rational, independent judgment.” Fed. Prescription, 663 F.2d at 267.

Appellants wrongly assert that Federal Prescription’s “less attractive” formulation demands proof of the underlying claim just to get the opportunity to prove it at trial. Pl. Br. 30. It does nothing of the kind. What it demands is evidence that would permit a reasonable trier of fact to find a conspiracy, which is exactly what Matsushita demands.

The district court did what it was required to do. “If the defendant in a run-of-the-mill civil case moves for summary judgment or for a directed verdict based on the lack of proof of a material fact, the judge must ask himself not whether he thinks the evidence unmistakably favors one side or the other but whether a fair-minded jury could return a verdict for the plaintiff on the evidence presented.” Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 252 (1986). The court asked that question, and the answer was no.

B. The District Court Applied the Standard Correctly

“[A]ntitrust law limits the range of permissible inferences from ambiguous evidence in a § 1 case.” Matsushita, 475 U.S. at 588. But “Matsushita demands only that the nonmoving party’s inferences be reasonable in order to reach the jury.” Eastman Kodak Co. v. Image Tech. Servs., Inc., 504 U.S. 451, 468 (1992). And Appellants argue that “inferences of collusion . . . are entirely permissible here.” Pl. Br. 37.

In carefully reviewing the evidence, the district court was not, as Appellants argue, “usurping the jury’s role.” Pl. Br. 31. The district court applied the Matsushita standard and granted summary judgment because “a reasonable jury could not conclude” that Defendants’ actions relating to their FSCs were “the result of a conspiracy.” Op. 37.

Contrary to Appellants’ claim, the district court did not draw “improper inferences” in concluding that “Defendants’ focus on FSCs was driven by erratic and rapidly rising fuel prices.” Pl. Br. 43–44. Uncontroverted government data demonstrated “erratic and rapidly rising fuel prices.” With occasional ebbs, oil prices doubled between the Spring of 2003 and the Summer of 2005, and then doubled again by the Summer of 2008. Dep’t of Energy, Energy Info. Admin., Cushing, OK WTI Spot Price, www.eia.gov/dnav/pet/hist/RWTCD.htm.

The district court was amply justified in concluding that erratic and rapidly rising fuel prices gave Defendants “a rational business motivation for aggressively pursuing higher FSCs.” Op. 70 (capitalization altered). And the court rightly observed that “an independent business justification for the defendants’ behavior makes inferring the requisite illegal conspiratorial agreement for a Sherman Act section 1 violation more difficult.” Op. 70.

Appellants argue that the evidence of Defendants’ meetings nevertheless could support a reasonable inference of conspiracy. Pl. Br. 46–50. But the district court carefully reviewed the evidence and concluded that “none of the meetings relied on by plaintiffs aid them in making plausible an inference of conspiracy.” Op. 120. Defendants “had a few meetings and a handful of sporadic communications where FSCs may have merely come up, though not contemporaneously to any change in defendants’ conduct or the context of creating an agreement.” Op. 152.

The district court correctly concluded that the mere fact of the meetings was not a permissible basis for inferring conspiracy. Op. 105–07, 152. Pairs of Defendants communicated because they partnered in numerous “interline” movements. Op. 7–8. Interline movements were quite important because Defendants CSX and NS operated in the East, while Defendants BNSF and UP operated in the West. Op. 6.

Appellants point to a May 2003 meeting at which NS and UP allegedly agreed that “it would be a positive outcome if all roads had the same process in the eyes of our customers.” Pl. Br. 49–50. The district court observed that the meeting occurred shortly after NS and UP announced FSC formulas and there was no evidence of parallel action following the meeting, which “undercuts any inference” of conspiracy. Op. 115–16.

Appellants point to a July 2003 meeting between BNSF and NS, several months after the conspiracy’s alleged onset, discussing a “potential industry position” on FSCs. Pl. Br. 48–49. Appellants ignore the district court’s observation that discussing a “potential” position “suggests that none was extant already” and thus “undermines plaintiffs’ alleged conspiracy.” Op. 119.

Appellants argue that the “district court read Matsushita to require that Plaintiffs show inter-Defendant pricing dialogues tethered to ‘simultaneous’ (or ‘near-simultaneous’) and ‘unusual’ lockstep pricing actions across all Defendants.” Pl. Br. 35. The district court did no such thing. Instead, it carefully examined the evolution of Defendants’ FSCs for any parallelism from which a reasonable jury could have inferred a conspiracy. Op. 42–69.

Nor did the district court fall into the “trap” of “considering Plaintiffs’ conspiracy evidence piecemeal,” as Appellants argue. Pl. Br. 45. Judge Posner identified this “trap” but observed that “zero plus zero equals zero.” In re High Fructose Corn Syrup Antitrust Litig., 295 F.3d 651, 655 (7th Cir. 2002). The district court rightly concluded that most of Plaintiffs’ evidence was a “zero,” and it concluded that “all of plaintiffs’ evidence together” did “not tend to exclude the inference of independent action.” Op. 150.

The district court recognized that the “ultimate inquiry . . . is a holistic one,” Op. 150, because the whole of Plaintiffs’ circumstantial evidence could be greater than the sum of its parts, Op. 40–41, 149–50. And the court concluded that the evidence, “evaluated cumulatively,” did not tend to exclude the possibility of independent action. Op. 151. Appellants disparage the district court’s holistic assessment of the evidence but identify no synergy in the evidence that the district court overlooked. Pl. Br. 46–47.

Viewing the evidence as a whole, the court concluded that it did not tend to exclude the possibility of independent action, “especially given the strong showing made by defendants that they acted in their unilateral self-interest.” Op. 151. “[T]here is no reason to infer that [Defendants] had agreed among themselves to do what was only natural anyway.” Twombly, 550 U.S. at 566.

C. The Missing Plus Factor Is Action Against Self-Interest

“A plaintiff may establish a conspiracy under Section 1 of the Sherman Act by circumstantial evidence such as inferences drawn from the behavior of the alleged co-conspirators.” Kreuzer v. Am. Acad. of Periodontology, 735 F.2d 1479, 1487–88 (D.C. Cir. 1984). “Such an inference may only be drawn, however, when an alleged conspirator has acted contrary to his own independent interest.” Id. at 1488.

Kreuzer is consistent with Matsushita and Twombly. Recapitulating the holding of Matsushita, Twombly observed that conduct “consistent with conspiracy” is of no avail to plaintiffs opposing summary judgment if it is “just as much in line with a wide swath of rational and competitive business strategy unilaterally prompted by common perceptions of the market.” Twombly, 550 U.S. at 554. Thus, marketplace conduct supports an inference of conspiracy only when it is contrary to unilateral self-interest.

“Where the conduct of an alleged co-conspirator is in its own economic self-interest only if the other alleged co-conspirators follow suit, there is strong circumstantial evidence of a conspiracy.” Honey Bum, LLC v. Fashion Nova, Inc., 63 F.4th 813, 823 (9th Cir. 2023). Put another way, conspiracy can be inferred from “perilous” conduct, which cedes business unless rivals respond in a parallel fashion and thus bypass opportunities to gain business. Kleen Prods. LLC v. Ga.-Pac. LLC, 910 F.3d 927, 937–38 (7th Cir. 2018).

Parallel conduct supported an inference of conspiracy in Interstate Circuit, Inc. v. United States, 306 U.S. 208, 221–22 (1939). “Key to Interstate Circuit’s conspiracy finding was its determination that each distributor’s decision to accede to Interstate’s demands would have been economically self-defeating unless the other distributors did the same.” In re Ins. Brokerage Antitrust Litig., 618 F.3d 300, 331 (3d Cir. 2010).

Appellants argue that Defendant’s FSCs during the period of alleged conspiracy “were a significant break from the surcharges of the past.” Pl. Br. 25. But fuel prices indisputably soared; Defendants had powerful self-interested reasons to act in response; and aggressive use of FSCs was an obvious and sensible action. Appellants do not argue that breaking from the past was “perilous” or unwarranted by circumstances.

“Here, detailed evidence of each defendant’s internal debates and analyses . . . demonstrates independent decision-making and logical, self-interested business justifications for the choices each defendant made.” Op. 77, see Op. 139–43. Appellants identify no factual dispute as to whether either the construction of Defendant’s FSCs or the expansion of their coverage was consistent with independent self-interest.

II. The Amici Provide No Sound Basis for Reversing the Grant of Summary Judgment

A. The District Court Did Not Demand Unusual Parallelism

Amicus curiae States and the American Antitrust Institute mistakenly assert that the district court granted summary judgment on the basis that Plaintiffs could not show unusual parallelism. Brief for the District of Columbia and 22 States as Amicus Curiae in Support of Appellants (St. Br.) 15–19; Brief of the American Antitrust Institute (AAI) in Support of Plaintiffs-Appellants and Reversal (AAI Br.) 5–13, 16–17.

Circumstantial proof of a price-fixing conspiracy entails inference from conduct, especially parallel prices and parallel price movements. See, e.g., Am. Tobacco Co. v. United States, 328 U.S. 781, 804–05 (1946); High Fructose, 295 F.3d at 654. In ruling on summary judgment, a court determines what inferences a reasonable jury could draw from the conduct documented in the record within the context of the other evidence.

“Parallel behavior of a sort anomalous in a competitive market” supports an inference of conspiracy. In re Text Messaging Antitrust Litig., 782 F.3d 867, 870 (7th Cir. 2015). And parallel conduct can support an inference of conspiracy if “inconsistent with that to be expected from each party individually pursuing his own interest.” Kreuzer, 735 F.2d at 1487.

The State and AAI amici argue that the district court erred by asserting: “Parallel conduct . . . requires pricing decisions so ‘unusual,’ they could not be expected from an ordinary competitive market.” Op. 48, quoted by St. Br. 15–16; AAI Br. 5, 14. The court’s phrasing was not ideal, but it correctly described parallelism that would support an inference of conspiracy. See Twombly, 550 U.S. at 556 n.4 (“[C]omplex and historically unprecedented changes in pricing structure made at the very same time by multiple competitors, and made for no other discernible reason, would support a plausible inference of conspiracy.” (internal quotation marks omitted)).

The amici do not question the district court’s conclusion that a reasonable jury could not infer conspiracy from the details and evolution of Defendants’ FSCs. Op. 42–69. The amici argue instead that the court erred by treating the absence of unusual parallelism as a sufficient basis for granting summary judgment. St. Br. 15–19, 24; AAI Br. 5–6, 11, 14, 16, 19–20. But the court did not do that. After concluding that no parallels in Defendants’ FCSs could support an inference of conspiracy, the court devoted nearly 100 pages to exhaustively reviewing all the other evidence.

Amicus AAI alone argues that parallel conduct is a “threshold” trivially crossed because Defendants’ small numbers made their actions “invariably parallel.” AAI Br. 5, 7–9, 13. And once the threshold was crossed, AAI argues that “the district court should have ended its inquiry into parallel conduct.” AAI Br. 7. AAI’s authority for the threshold notion is a pleading decision. Mosaic Health, Inc. v. Sanofi-Aventis U.S., LLC, 156 F.4th 68 (2d Cir. 2025), cited at AAI Br. 5–6, 13. And AAI asserts that the district court “raise[d] the bar for pleading.” AAI Br. 5.

In ruling on summary judgment, the court was tasked with determining whether the evidence “tends to exclude the possibility that the alleged conspirators acted independently.” Matsushita, 475 U.S. at 588 (internal quotation marks omitted). The nature and extent of parallelism unquestionably was relevant. See, e.g., Twombly, 550 U.S. at 553, 556 n.4.

B. The District Court Did Not Rely on “Mere Interdependence”

On the authority of a single article, the academic amici argue that courts systematically err in evaluating circumstantial evidence of collusion by assuming that all parallel conduct could be due to “mere interdependence.” Brief of Amicus Curiae Antitrust Law and Economics Professors in Support of Plaintiffs-Appellants and Reversal (Acad. Br.) 2–4, 7–8.

But the district court did not explain Defendants’ aggressive use of FSCs as “mere interdependence,” and the academic amici offer scant support for the charge that the “‘mere interdependence’ assumption runs throughout” the court’s opinion. Acad. Br. 8; see AAI Br. 20 (“The district court’s analysis also rests on an economically incorrect assumption that interdependence necessarily explains supracompetitive pricing in an oligopoly.”).

The district court observed that Defendants’ actions were “not completely independent but rather interdependent.” Op. 72. Defendants’ FSC formulas were public, and the court noted the attention that Defendants paid to each others’ formulas. Op. 78–94. As the court acknowledged, interdependent competitors always take account of each others’ actions. Op. 36, 38–39.

Interdependent competitors sometimes act in parallel. Op. 39–44. And the district court noted that Defendants sometimes emulated one another’s FSC formulas. Op. 78–79 (CSX emulated BNSF), 82–83 (UP emulated BNSF), 89, 91 (NS emulated CSX). But the district court did not rely on “mere interdependence” to explain why all four Defendants’ began aggressively pursuing FSCs in 2003.

The district court carefully examined the record and concluded that the “detailed evidence of each defendant’s internal debates and analyses as each one considered when and how to change its FSCs demonstrates independent decision-making.” Op. 77 (emphasis added), see id. 139–40. In other words, the court concluded that Defendants’ pursuit of FSCs was a “rational and competitive business strategy unilaterally prompted by common perceptions of the market.” Twombly, 550 U.S. at 554.

C. Plus Factors Do Not Tend to Exclude the Possibility of Independent Action

While appellants mention “plus factors” in passing, Pl. Br. 26, 34, 35, the academic amici focus on them, Acad. Br. 6–8, 14–23. Citing only “plus factors,” the academic amici claim that “more than enough evidence exists for a reasonable juror to infer an agreement.” Acad. Br. 27. As a practical matter, the amici argue that summary judgment in antitrust conspiracy cases is a box-ticking exercise and that Plaintiffs ticked the necessary boxes.

Unlike recent appellate decisions, the academic amici do not analyze “plus factors” in the context of Matsushita and Twombly. The amici do not explain why particular “plus factors” necessarily “show that the inference of conspiracy is reasonable in light of the competing inference[] of independent action.” Matsushita, 475 U.S. at 588.

The academic amici baselessly argue that the district court held that “multiple long-established plus factors are no longer valid.” Acad. Br. 7–8. The notion of “long-established plus-factors” is problematic at the start because “plus factors” are not fixed and invariant. Actions and background facts become “plus factors” when, in a particular context, they “make the inference of rational independent choice less attractive than that of concerted action.” Lum v. Bank of Am., 361 F.3d 217, 230 (3d Cir. 2004).

Citing Twombly, the Ninth Circuit explained that “plus factors are economic actions and outcomes that are largely inconsistent with unilateral conduct but largely consistent with explicitly coordinated action.” In re Musical Instruments & Equip. Antitrust Litig., 798 F.3d 1186, 1194 (9th Cir. 2015); see also In re Publ’n Paper Antitrust Litig., 690 F.3d 51, 62 (2d Cir. 2012) (“Plus factors” are “circumstances” that, “when viewed in conjunction with the parallel conduct, would permit a fact-finder to infer a conspiracy”).

The district court conducted a holistic analysis of the evidence, as the academic amici and AAI advocate. Acad. Br. 25–27, AAI Br. 12. But the court’s holistic analysis, unlike that advocated by the amici, faithfully applied the Matsushita standard. Applying that standard, the court correctly concluded that Plaintiffs’ purported “plus factors” were insufficient.

Rather than treat Plaintiffs’ purported “plus factors” as boxes to be ticked, the district court viewed them in light of Matsushita’s requirement that Plaintiffs “show that the inference of conspiracy is reasonable in light of the competing inference[] of independent action.” Matsushita, 475 U.S. at 588. The academic amici wrongly characterize the district court’s analysis as holding Plaintiffs’ “plus factors” to be “irrelevant.” Acad. Br. 13–14, 17, 19.

The district court correctly concluded that high concentration, high entry barriers, and inelastic demand suggested weak competition but did “not push plaintiffs over the line toward an inference of conspiracy.” Op. 145. The amici wrongly assert that the court held these market characteristics “irrelevant to Sherman Act agreement analysis.” Acad. Br. at 13–16. The district court correctly concluded that a “conspiratorial motive does not move the needle in plaintiffs’ favor” given that Defendants had a “clear rational business motive” to use FSCs aggressively in coping with rising fuel prices. Op. 105. The amici wrongly assert that the district court held a motive to conspire “irrelevant to the agreement inquiry.” Acad. Br. 13, 17–19.

The district court correctly concluded that communications among Defendants “should be accorded little, if any weight” in view of their content and the context in which they occurred. Op. 105. The amici wrongly assert that the district court held the communications “irrelevant to the agreement inquiry.” Acad. Br. 19–24 (capitalization altered).

Another error attributed by the amici to the district court is analyzing “the common-motive evidence in isolation from market-structure evidence.” Acad. Br. 19. But doing so would have been to Plaintiffs’ benefit. High concentration, high entry barriers, and inelastic demand tend to yield weak competition and high profits without collusion (and without “conscious parallelism”), which results in a weak motive to conspire and run the risk of prosecution and payment of treble damages.

The academic amici submit that price-fixing allegations based on parallel conduct should always survive summary judgment if plaintiffs show that market structure is conducive to collusion and that the defendants had motive and opportunity to conspire. Acad. Br. 3, 27–28. This submission is irreconcilable with Matsushita because these boxes can be ticked even if the evidence does not tend to exclude the possibility of independent action.

In a market structure conducive to collusion, competitors “recognize a mutual interdependence of their price-output decisions, and therefore act interdependently.” Joe S. Bain, Industrial Organization 114 (2d ed. 1968); see In re Flat Glass Antitrust Litig., 385 F.3d 350, 359 (3d Cir. 2004). The results can be parallel conduct and diminished competitive vigor, which may be undesirable, but they are not a sufficient basis for inferring conspiracy. See, e.g., Twombly, 550 U.S. at 553–54, Op. 145.

Motive is ubiquitous. The Ninth Circuit observed that: “Any firm that believes that it could increase profits by raising prices has a motive to reach an advance agreement with its competitors.” See Musical Instruments, 798 F.3d at 1194. A motive to conspire exists whenever there is competition, but criminal enforcement and treble damages actions are potent deterrents. The district court was right to conclude that “a mere motive to conspire does not alone tend to exclude the possibility of independent action.” Op. 104.

Competitors legitimately communicate on matters of industry concern. “Atypical communications between alleged coconspirators can constitute a plus factor because such communications provide the opportunity for parties to come to (and enforce) an illicit agreement. But to qualify as a plus factor, such communications must go beyond the ‘standard fare’ of business and trade-association practice.” Honey Bum, 63 F.4th at 823.

After a holistic review of a voluminous record, the district court wrote a thorough 166-page decision. The court properly concluded that Plaintiffs’ “evidence lacks the crucial thrust of a conspiracy claim: facts that tend to exclude the possibility that defendants acted unilaterally and made their decisions independently.” Op. 165–66.

Conclusion

This Court should affirm the district court’s June 24, 2025 grant of summary judgment.

I. Introduction

The International Center for Law & Economics (ICLE) submits these comments in response to the Autorité de la Concurrence’s public consultation on the competitive situation in the conversational agents sector. ICLE is a non-profit research centre that applies economic analysis to legal and regulatory questions, with a particular focus on competition policy and market institutions.

These comments assess the competitive implications of integrating AI applications into digital ecosystems under both competition law and sector-specific regulation. They address several issues raised in the consultation, particularly the integration of conversational agents into the existing services of vertically integrated firms (Section I.B of the consultation). The analysis also engages with partnerships in this area (Section I.D), the evolving role of conversational agents as platforms (Section I.E), and the adequacy of the current legislative and regulatory framework (Section III, Question 25).

Artificial intelligence (AI) is emerging as a general-purpose technology with immediate implications for competition policy.[1] As deployment spreads across search, commerce, productivity software, and communications services, AI tools are beginning to reshape how firms compete, organise production, and interact with users. At the downstream level, foundation models enable new product categories and add new functionality to existing digital services.

Much of this transformation centres on AI assistants and agents. These systems increasingly mediate users’ online activity and shift the traditional web-browsing experience toward AI-centred interaction.[2]

AI assistants—e.g., OpenAI ChatGPT, Google Gemini, Microsoft Copilot, Anthropic Claude, Meta AI Assistant, and Mistral Le Chat—are primarily reactive, language-based systems. They interpret natural-language prompts and generate responses using probabilistic reasoning and, in some cases, tool-augmented capabilities. Their operation remains prompt-driven: users initiate the task and define its boundaries.

Alongside these systems, early agentic tools—e.g., OpenAI Operator, Anthropic Claude’s Computer Use, Perplexity’s Buy with Pro, and Google DeepMind’s Project Mariner—operate differently. They initiate actions, interact with external software environments, and adjust behaviour to pursue specified objectives. They can execute multi-step workflows and sustain continuous processes that extend beyond simple response generation. The distinction is functional rather than semantic: assistants answer questions, while agents perform tasks.

The rapid expansion of generative AI has increased both the number and diversity of these systems.[3] AI assistants and agents increasingly function as access points to digital services, rather than standalone applications.[4] Through a single interface, users can search, shop, book services, retrieve documents, or interact with third-party tools without leaving the conversational environment. AI-enabled browsers, including OpenAI’s ChatGPT Atlas and Perplexity’s Comet, reinforce this shift.

Firms are deploying these capabilities through two primary strategies. Some partner with third-party AI developers, while others build proprietary systems and embed them into existing ecosystems. This divergence reflects the competitive relationship between incumbent platforms and AI entrants. New entrants seek distribution through widespread embedding across platforms, while incumbents deploy vertically integrated AI to retain users within their ecosystems.

Competition authorities have begun to scrutinise these developments. Integration may improve quality and reduce transaction costs, but regulators have expressed concerns that it may also reinforce market power. Agencies have raised issues relating to tying, foreclosure, and self-preferencing, particularly where AI tools are embedded in widely used services.[5] Jurisdictions that adopted ex ante digital-market regulation are already reassessing whether those frameworks adequately address AI-enabled conduct.[6]

Early disputes illustrate the emerging terrain. Amazon has sued Perplexity, alleging that its agent accessed user accounts and masked automated activity as human browsing.[7] Elon Musk has threatened litigation accusing Apple of manipulating App Store rankings to favour OpenAI’s ChatGPT after Apple integrated the service into iOS devices.[8] Meanwhile, the Italian competition authority opened proceedings regarding Meta’s preinstallation of Meta AI within WhatsApp.[9]

These comments analyse the competitive implications of integrating AI applications into digital ecosystems under both antitrust law and sector-specific regulation.

From an antitrust perspective, the core issues are not new. They resemble longstanding debates over vertical integration and self-preferencing in digital markets.[10] Existing competition law remains sufficiently flexible to address exclusionary conduct. The real novelty lies elsewhere: AI markets currently exhibit rapid entry, experimentation, and technological uncertainty. The speed with which new services and firms have emerged complicates predictions about durable market power. Replicating familiar anti–Big Tech analytical frameworks risks misdiagnosing competitive dynamics in a still-fluid environment.

The same caution applies to digital-platform regulation. A Big Tech-centric regulatory approach creates asymmetric coverage. The European Union’s (EU) Digital Markets Act (DMA), for example, captures AI functionality integrated into designated core platform services,[11] yet standalone AI applications may fall outside its scope regardless of their growth or competitive significance. The rise of agentic systems highlights the difficulty regulators face in anticipating technological trajectories.[12]

Policy therefore confronts two opposing risks: delayed intervention that allows anticompetitive conduct to entrench, and premature intervention that distorts competition in evolving markets.

The comments proceed as follows. Section II examines business strategies for deploying assistive AI services and uses the Meta AI investigation to illustrate potential antitrust concerns arising from integration into core ecosystems. Section III analyses the challenges AI technologies pose for recently enacted digital-market regulations. Section IV evaluates the limits of a Big Tech-centric framework and questions the assumption that AI markets will follow the historical trajectory of earlier digital platforms. Section V concludes.

II. Competitive Strategies for Deploying AI Assistants and Agents

AI assistants and agents have become a central competitive frontier in online markets. A growing share of users rely on these tools to interact with digital systems, retrieve and synthesise information, automate tasks, and delegate bounded autonomous actions across platforms and services. The rapid cadence of model releases and the ongoing race for performance leadership reflect both the importance of these applications and the intensity of rivalry in this sector.

Competition between incumbent technology firms and AI entrants increasingly turns on how these systems are adopted and distributed. Because AI assistants may mediate—or potentially displace—traditional general-purpose search and other gateway services,[13] new entrants pursue rapid diffusion through embedding across multiple platforms. Incumbent firms instead face a familiar make-or-buy decision: partner with external AI developers or build proprietary systems.

Each option presents tradeoffs. Partnerships allow incumbents to reach competitive parity quickly and reduce disruption risk by aligning with potential rivals. Over time, however, reliance on third-party technology may create strategic dependence on external providers and their commercial success.[14] Internal development preserves control but requires substantial investment and entails technological uncertainty.

Observed market behaviour reflects these incentives. Many incumbents have integrated proprietary AI functionality into existing ecosystems. Google has incorporated generative-AI features into Gmail, Google Docs, and Search. Meta has embedded AI assistants into WhatsApp, Messenger, and Instagram. Microsoft integrated Copilot into the Office suite, although its early capabilities relied heavily on its partnership with OpenAI. Microsoft has since diversified Copilot’s architecture by combining internal and external models to reduce reliance on OpenAI.

Many partnerships instead focus on upstream AI inputs—cloud infrastructure, computing chips, training data, and technical expertise—or take the form of financial investment, rather than distribution agreements.[15]

New entrants typically pursue a different strategy. OpenAI’s launch of ‘apps in ChatGPT’ allows users to run third-party applications inside conversations, supported by an open developer toolkit (the Apps SDK).[16] Early partners include Booking.com, Canva, Coursera, Expedia, Figma, Spotify, and Zillow, with additional participants such as OpenTable, Peloton, Target, Tripadvisor, and Uber expected to join.

OpenAI has also pursued commerce integration. Companies including Etsy, Shopify, and Walmart allow users to browse and purchase products directly through ChatGPT.[17] A partnership with PayPal enables instant checkout through PayPal’s digital wallet, while PayPal processes merchant payments.[18]

Incumbents have responded with similar initiatives. Google has partnered with firms including Shopify, Etsy, Wayfair, Target, and Walmart to develop an open standard for agentic commerce. The system allows users to complete purchases through Search or the Gemini application without switching between apps or webpages.[19]

Competition authorities have expressed concern about both types of strategies.

First, regulators scrutinise partnerships between large platforms and AI developers.[20] These arrangements may generate pro-competitive benefits by giving entrants access to capital, distribution, and essential inputs such as specialised computing capacity. Authorities nonetheless worry that partnerships may neutralise emerging competitors—for example, through contractual restrictions that limit downstream competition—and thereby reinforce incumbent positions across the AI value chain.[21]

Second, agencies have focused on the integration of AI into core platform services.[22] Ecosystem integration can improve product quality and reduce transaction costs, but authorities warn it may also create foreclosure risks. Regulators frequently invoke tying and self-preferencing theories of harm. Platforms may condition access to core services on the use of proprietary AI or advantage their own tools through preinstallation, exclusive integration, or interoperability limits. Such practices could restrict user choice and raise barriers to rival applications.

Taken together, scepticism toward both partnerships and internal development reflects a broader concern that AI may strengthen existing digital ecosystems, rather than disrupt them.[23] Current policy debates therefore often adopt a Big Tech–centric perspective.

The ongoing Meta AI investigation provides a useful case study for evaluating these issues and the competitive implications of foundation-model assistants embedded within established digital ecosystems.

A. Meta AI and WhatsApp: Assessing Tying Risks in AI Integration

In July 2025, the Italian competition authority (ICA) opened an antitrust investigation into Meta’s decision to preinstall Meta AI within WhatsApp, combining its messaging service with its proprietary AI assistant.[24] The authority emphasised that Meta AI appears in a prominent interface position and is integrated into the WhatsApp search bar, allowing users to interact with the assistant without opening a separate chat.[25]

The ICA also identified limits on user control. Users can access competing AI services by initiating separate chats, but they cannot remove the Meta AI interface elements.[26] The authority further noted uncertainty regarding training data. Interactions with Meta AI appear to contribute to model training, except for private messages and instances in which users explicitly opt out in specific chats.[27]

The investigation therefore centres on an alleged tying practice. In the ICA’s view, preinstallation and preferential placement may give Meta an advantage in the AI-chatbot market by leveraging its position in consumer messaging services.[28] The concern is that Meta may steer WhatsApp’s large user base into the emerging AI market not through competition on the merits, but through product integration.[29]

The authority also emphasised the potential interaction between distribution and data. If Meta trains its model using interactions generated through a dominant messaging service, user-base leverage and data accumulation may reinforce one another. This feedback loop could create lock-in effects and reduce reliance on competing assistants.[30]

Despite the technological novelty of AI, the theory of harm is familiar. The case fits within a well-established vertical-integration framework, rather than introducing a new antitrust doctrine. Competition law has repeatedly addressed similar conduct in digital markets,[31] and existing rules do not require structural revision simply because the product incorporates AI.

European precedent illustrates the point. In Microsoft, the General Court held that the ubiquity of a dominant operating system could foreclose competition in the tied software market.[32] Bundling software with a preinstalled operating system allowed the tied product ‘to benefit from the ubiquity of that operating system … which cannot be counterbalanced by other methods of distributing media players’.[33]

A decade later, in Google Android, the European Commission found that Google preserved and strengthened its dominance in general search by requiring device manufacturers to preinstall Google Search and Chrome as a condition for licensing the Play Store and by imposing contractual restrictions that locked Android into a Google-controlled ecosystem.[34] The Commission concluded that preinstallation created a status quo bias that reduced both manufacturers’ incentives to preinstall rival applications and users’ incentives to download them.

More recently, in Facebook Marketplace, the Commission determined that tying Facebook Marketplace to Facebook abused Meta’s dominant position because integration provided a distribution advantage that rival platforms could not replicate.[35] Embedding Marketplace within the Facebook interface ensured universal visibility.[36] Although users could adjust certain settings, doing so required multiple complex steps that limited practical effectiveness.[37]

U.S. law reflects similar concerns. The U.S. District Court for the District of Columbia held that Google secured default-search status through anticompetitive distribution agreements with browser developers, device manufacturers, and carriers.[38] The U.S. District Court for the Northern District of California likewise found that Google unlawfully tied access to the Play Store to the use of Google Play Billing.[39] The court barred Google from requiring Play Billing for distributed applications and from imposing contractual restrictions that conditioned payment, distribution, or access to the Play Store on exclusive or preferential treatment.

Against this background, the ICA can rely on a well-developed tying framework. The authority must establish that: (i) the tying and tied products are distinct; (ii) Meta holds a dominant position in the tying market; (iii) users lack a genuine choice to obtain the tying product independently of the tied product; and (iv) the conduct is capable of producing exclusionary effects.

The outcome, however, need not replicate prior cases. AI markets remain highly dynamic and characterised by considerable competitive uncertainty. Even if Meta seeks to leverage messaging dominance into AI services, success cannot be presumed. The relevant question is whether preinstallation confers an advantage that rivals cannot offset through alternative distribution, product quality, or innovation.

The investigation has since expanded. The ICA also examined Meta’s October 2025 business terms, which prohibit providers from using the WhatsApp Business Solution when AI assistants constitute the primary service offered.[40] AI tools remain permitted for ancillary functions, such as automated customer support. The ICA adopted interim measures,[41] and both the European Commission and the Brazilian competition authority opened parallel inquiries.[42]

Authorities worry that the WhatsApp policy may restrict output, market access, or technical development by preventing rival assistants from reaching users through WhatsApp. Meta responds that general-purpose chatbots fall outside WhatsApp’s intended function as a communication tool between businesses and users, and that supporting such systems would require substantial operational resources.[43]

Although these comments focus on the integration of Meta AI into WhatsApp, the parallel investigations provide additional insight into market conditions. The ICA’s interim measures suggest a market with multiple entrants attempting to reach users.[44] Some are smaller providers without proprietary distribution channels—e.g., Ira, Luzia, Poke, Puch AI, and Zapia—while others, including ChatGPT, Copilot, and Perplexity, already possess alternative distribution pathways. The dispute therefore turns not only on dominance, but also on whether messaging platforms function as essential gateways to user access.

III. AI and the Limits of Digital-Market Regulation

If AI complicates antitrust analysis, it poses an even sharper challenge for recently enacted digital-market regulation. The same technological change that motivates regulatory intervention may also undermine it. Rapid advances in AI risk rendering new regulatory frameworks incomplete or outdated.

The Digital Markets Act (DMA) illustrates the problem. As part of the Act’s first review, the European Commission is consulting stakeholders on whether the framework adequately addresses AI-enabled services and whether the list of core platform services and related obligations requires revision.[45] The DMA—like other digital-market regimes—was not designed with AI in mind. Legislators instead targeted large online platforms designated as gatekeepers: firms that serve as gateways for business users to reach consumers and can leverage advantages—particularly access to data—across markets.

AI services may fall within DMA-type regulation through two main channels. First, an AI provider could itself offer a core platform service and qualify as a gatekeeper. Second, AI functionality embedded within an already designated platform service becomes subject to the obligations governing that service. The result is a differentiated regulatory landscape that treats incumbent platforms and AI entrants differently.

For incumbents, integration brings AI features within the DMA’s scope. The primary question then becomes whether existing obligations can adapt to new technologies. The European Commission’s ongoing specification proceeding concerning Google illustrates this dynamic. The proceeding seeks to ensure that Google provides third-party AI services access to Android operating-system features comparable to those available to its own services, consistent with the vertical-interoperability requirement of Article 6(7) of the DMA.[46]

Standalone AI providers face the opposite situation. The DMA may not apply at all, regardless of market significance, because standalone AI applications do not clearly fit within any enumerated core platform service. Unless regulators reinterpret existing categories—e.g., search engines, browsers, or virtual assistants—AI developers cannot be designated as gatekeepers solely on the basis of AI offerings.[47] This structural gap is particularly salient for agentic systems, which may reshape market intermediation while remaining formally outside the regulation’s scope.[48]

Expanding regulation, however, carries its own risks. AI markets remain unsettled in technology, business models, and market structure. Extending ex ante obligations to AI services may constrain experimentation in product design, functionality, and platform architecture. Policymakers would need to predict both the direction and speed of technological change in an environment characterised by rapid innovation and uncertainty.

Premature regulation therefore risks misjudging market power. Authorities may underestimate future competition or overestimate the durability of concentration. Either error may distort innovation incentives and consumer outcomes. The regulatory problem is therefore symmetrical: waiting too long may allow harmful conduct to emerge, while acting too early may suppress competitive experimentation.

IV. Rethinking Big Tech-Centric Assumptions in AI Markets

Both the Meta AI investigation and the ongoing debate over revising the Digital Markets Act (DMA) reflect a similar analytical pattern. Assessments of AI competition remain anchored in the same Big Tech–centric framework that has shaped digital-market policy for two decades.

Competition authorities recognise that AI has stimulated innovation and entry. At the same time, many worry that markets for foundation models may follow the early trajectory of digital platforms.[49] In this view, economies of scale and scope, network effects, data feedback loops, and limited multi-homing could produce ‘winner-takes-most’ outcomes and eventual market tipping.[50] The concern is prospective: large technology firms might shape AI markets in ways that reduce future competition by leveraging existing advantages across layers of the AI stack.

The ICA’s Meta AI investigation reflects this reasoning. The authority emphasises that AI development requires substantial computing capacity, high-quality data, specialised labour, and investment capital.[51] Because large platforms control many of these inputs and operate vertically integrated ecosystems, regulators worry that they can resist disruption and extend market power into adjacent markets.[52]

Sound policy analysis, however, should compare AI systems with earlier digital platforms rather than assume they are equivalent.[53] The emerging literature highlights several differences.[54]

Network effects appear weaker for foundation models than for traditional platforms because individual users gain little value from the presence of additional users. Data feedback loops exist, but the strategic importance of proprietary data may be declining as datasets expand and synthetic data becomes more common. Investment patterns also show persistent entry. New AI firms continue to attract substantial funding across successive rounds,[55] indicating both investor confidence and expectations of continued competition.

In practice, many predicted entry barriers have proved less significant than anticipated. The diversity of downstream applications also makes universal tipping unlikely. Rather than converging on a single dominant platform, AI services increasingly specialise across different applications. Rapid market expansion and continued entry therefore challenge key assumptions underlying current policy debates and point to ongoing competitive pressure.

Some scholars further argue that static indicators of market power—such as market shares and margins—may understate competition in innovative industries.[56] Dynamic indicators, including investment levels, innovation rates, and the ability of smaller firms to attract capital, provide a more informative picture.[57] The emergence of firms such as OpenAI and Anthropic is difficult to reconcile with the claim that incumbents can seamlessly extend dominance into AI markets.[58]

Empirical evidence also complicates the narrative that data advantages determine competitive success. To date, large platforms have not translated existing data holdings into decisive superiority over AI startups. OpenAI’s ChatGPT, for example, has become the most widely used chatbot. By February 2025, it exceeded 400 million monthly active users[59] and accounted for roughly 86% of global chatbot traffic between April 2024 and March 2025.[60] By September 2025, it ranked among the world’s most visited websites,[61] and by November 2025 it was the most downloaded generative-AI mobile application.[62] Developer adoption likewise remains high.[63]

These figures nonetheless remain fluid. As of January 2026, ChatGPT’s traffic share had declined to roughly 65% amid growing competition from Gemini.[64] Anthropic’s Claude has also expanded rapidly and is projected to reach break-even earlier than OpenAI.[65] The relevant point is not which firm leads, but how quickly leadership can change.

Rapid turnover weakens predictions of durable concentration. Even unsuccessful entry can discipline incumbents in contestable markets.[66] The threat of displacement may therefore matter as much as observed market shares.

Against this background, a presumption against integration strategies by large technology firms risks analytical error. The concern resembles longstanding scepticism toward vertical integration. Yet vertical integration can generate efficiencies, eliminate double marginalisation, reduce transaction costs, and improve product quality and coordination.

Applying traditional anti–Big Tech reasoning to AI disregards current market conditions. The sector shows sustained entry, diverse business models, rapid innovation, and abundant capital. Large platforms do not appear to hold a decisive structural advantage.

The Meta AI case illustrates the point. It is uncertain that integrating Meta AI into WhatsApp would materially harm competition in AI assistants, particularly given the success of rivals such as ChatGPT. ChatGPT achieved rapid adoption through cross-platform integration and partnerships that allow users to shop, book services, and perform other tasks within a single interface. By contrast, Meta AI’s market share remained minimal—about 0.2% between April 2024 and March 2025[67] and below 1% in January 2026[68]—and developer adoption remained limited.[69]

Industry practice further weakens a categorical rule against integration. Firms routinely use their own services as distribution channels for AI tools. In recent U.S. litigation, Judge Amit Mehta rejected a proposed remedy that would have broadly prohibited Google from favouring its Gemini system within Chrome.[70] He warned that such a restriction would impair competition:

Such a restriction would set Google apart from its competitors. … The court will not hobble Google’s competitiveness by prohibiting self-preferencing of its own GenAI technologies, when that is precisely how the emerging—and highly competitive—GenAI marketplace operates.[71]

Extending traditional anti–Big Tech assumptions to AI markets therefore risks counterproductive enforcement. Restrictions on integration strategies could weaken competitive pressure on leading AI firms and produce the opposite of the intended effect. The risk is particularly pronounced where digital-platform conduct already faces substantial constraints under DMA-type regulation.

V. Conclusion

ICLE welcomes the Autorité’s decision to launch this public consultation and appreciates the opportunity to contribute to its analysis of competition in the conversational agents sector. In light of the issues examined above, we highlight several considerations relevant to the themes identified in the consultation.

With respect to the integration of conversational agents into the existing services of vertically integrated firms (Section I.B of the consultation), the Autorité should avoid presuming that integration is inherently anticompetitive. Vertical integration and product embedding often generate efficiencies, improve coordination among complementary services, and accelerate the deployment of new technologies. As the Meta AI investigation illustrates, the relevant question is not whether integration occurs, but whether it forecloses rivals that retain alternative distribution channels and the capacity to innovate. Authorities should continue to apply established antitrust doctrine to demonstrably exclusionary conduct, while avoiding the assumption that preinstallation, default placement, or preferential integration automatically extend earlier self-preferencing concerns.

Regarding partnerships among publishers of conversational agents (Section I.D), the analysis in these comments suggests that partnerships, ecosystem integration, and internal AI development represent standard competitive responses in a market defined by technological uncertainty and rapid innovation. AI markets currently exhibit frequent entry, high investment levels, and rapidly shifting competitive leadership. Network effects appear weaker than in traditional platforms, data advantages are less durable, and new firms continue to attract funding and users. The emergence of firms such as OpenAI and Anthropic demonstrates that incumbents have not seamlessly extended dominance into AI markets. Restricting the strategies under scrutiny could therefore reduce, rather than enhance, competitive rivalry by weakening an important constraint on leading AI firms.

On the question of whether conversational agents are evolving into platforms (Section I.E), the competitive landscape remains highly fluid. AI markets differ from earlier platform markets in economically relevant ways. Even leading positions remain unstable as competing models improve quickly. The Autorité should exercise caution before projecting the trajectory of earlier platform markets onto conversational agents. Rather than assuming that AI will replicate the dynamics of digital platforms, analysis should recognise that vigorous competition may already be occurring—and that premature classification of conversational agents as platforms risks triggering regulatory frameworks before market structures stabilise.

Finally, regarding the adequacy of the legislative and regulatory framework (Section III, Question 25), these comments identify a structural asymmetry in existing digital-market regimes. Frameworks such as the EU’s Digital Markets Act already impose substantial obligations on designated gatekeepers when AI functionality is integrated into core platform services. By contrast, standalone AI assistants and agents may fall outside these regimes altogether, regardless of their competitive significance. This mismatch suggests that the greater risk may not be insufficient oversight of incumbents, but rules designed for earlier intermediaries, rather than today’s forms of competition. ICLE therefore encourages the Autorité to consider this regulatory asymmetry and to avoid layering additional obligations that could reinforce, rather than correct, the imbalance.

In sum, competition policy in the conversational agents sector faces two symmetrical risks: delayed intervention that allows anticompetitive conduct to entrench, and premature intervention that distorts competition in evolving markets. Focusing exclusively on the first risk overlooks the second. AI markets remain uncertain, dynamic, and highly innovative. In these conditions, ICLE encourages the Autorité to prioritise evidence over analogy and to adopt a context-sensitive framework that reflects the distinctive competitive dynamics of these markets.

[1] See, e.g., Statista, Number of AI Tool Users Worldwide from 2020 to 2031 (in Millions) (2025), https://www.statista.com/outlook/tmo/artificial-intelligence/worldwide (last visited 9 Feb. 2026) (showing steady growth in global AI-tool users—from about 116 million in 2020 to roughly 350 million in 2025, with projections exceeding 1 billion by 2031).

[2] See, e.g., Org. for Econ. Co-operation & Dev. (OECD), Artificial Intelligence and Competitive Dynamics in Downstream Markets (2025), https://www.oecd.org/content/dam/oecd/en/publications/reports/2025/11/artificial-intelligence-and-competitive-dynamics-in-downstream-markets_c6e81d0e/ccf0624a-en.pdf; see also Amit Zac & Michal S. Gal, The Price of Advice: Experimental Evidence on the Effects of AI Recommenders (2025), https://papers.ssrn.com/sol3/papers.cfm?abstract_id=5637090 (finding that consumer-facing AI recommender systems influence purchasing decisions).

[3] See, e.g., CB Insights, Global Number of Deals and Funding for Agentic Artificial Intelligence (AI) Startups from 2020 to 2024 (2025), https://www.statista.com/statistics/1607697/global-agentic-ai-startup-dealsand-funding (showing rapid growth in the agentic-AI startup sector, with funding rising from about $24 million across eight deals in 2020 to roughly $3.8 billion across 162 deals in 2024); see also Deloitte, Interest in Generative Artificial Intelligence (AI) Developments in Organizations Worldwide in 2024 (2025), https://www.statista.com/statistics/1603062/interest-in-future-genai-related-developments (reporting that agentic AI ranked among organisations’ most salient technological developments in 2024).

[4] See, e.g., Press Release, Autorité de la Concurrence, Conversational Agents: the Autorité Starts Inquiries Ex Officio with a View to Issuing an Opinion (2026), https://www.autoritedelaconcurrence.fr/en/press-release/conversational-agents-autorite-starts-inquiries-ex-officio-view-issuing-opinion.

[5] Id.; Austl. Competition & Consumer Comm’n (ACCC), Digital Platform Services Inquiry—Final Report (2025), https://www.accc.gov.au/about-us/publications/serial-publications/digital-platform-services-inquiry-2020-25-reports/digital-platform-services-inquiry-final-report-march-2025; Autorité de la Concurrence, Opinion on the Competitive Functioning of the Generative Artificial Intelligence Sector (2024), https://www.autoritedelaconcurrence.fr/en/opinion/competitive-functioning-generative-artificial-intelligence-sector; U.K. Competition & Mkts. Auth. (CMA), AI Foundation Models—Updated Paper (2024), https://www.gov.uk/government/publications/ai-foundation-models-update-paper; Autoridade da Concorrência, Competition and Generative Artificial Intelligence (2023), https://www.concorrencia.pt/sites/default/files/documentos/Issues%20Paper%20-%20Competition%20and%20Generative%20Artificial%20Intelligence.pdf.

[6] See, e.g., Eur. Comm’n, Consultation on the First Review of the Digital Markets Act (2025), https://digital-markets-act.ec.europa.eu/consultation-first-review-digital-markets-act_en; Eur. Comm’n, Review of the Digital Markets Act—Call for Evidence, Ares(2025)6881572 (2025), https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=intcom:Ares(2025)6881572.

[7] Shirin Ghaffary & Matt Day, Amazon Sues to Stop Perplexity from Using AI Tool to Buy Stuff, Bloomberg (4 November 2025), https://www.bloomberg.com/news/articles/2025-11-04/amazon-demands-perplexity-stop-ai-agent-from-making-purchases (reporting that Amazon alleges a third-party AI shopping agent failed to disclose when it purchased on users’ behalf, threatening platform integrity and merchant choice); see also Perplexity Team, Bullying Is Not Innovation, Perplexity (4 November 2025), https://www.perplexity.ai/hub/blog/bullying-is-not-innovation.

[8] Surbhi Misra, Musk Says xAI to Take Legal Action Against Apple over App Store Rankings, Reuters (12 August 2025), https://www.reuters.com/sustainability/boards-policy-regulation/musk-says-xai-take-legal-action-against-apple-over-app-store-rankings-2025-08-12.

[9] See, e.g., Press Release, Autorità Garante della Concorrenza e del Mercato (AGCM), The Italian Competition Authority Launches Investigation into Meta over Abuse of Dominant Position (30 July 2025), https://en.agcm.it/en/media/press-releases/2025/7/A576.

[10] See, e.g., Giuseppe Colangelo, Antitrust Unchained: The EU’s Case Against Self-Preferencing, 72 GRUR Int’l 538 (2023); Pablo Ibáñez Colomo, Self-Preferencing: Yet Another Epithet in Need of Limiting Principles, 43 World Competition 417 (2020).

[11] Regulation (EU) 2022/1925 of the European Parliament and of the Council of 14 September 2022 on Contestable and Fair Markets in the Digital Sector and Amending Directives (EU) 2019/1937 and (EU) 2020/1828 (Digital Markets Act), 2022 O.J. (L 265) 1.

[12] See, e.g., Friso Bostoen & Jan Kramer, Is the DMA Ready for Agentic AI?, Centre on Regulation in Europe (CERRE) (2025), https://cerre.eu/publications/is-the-dma-ready-for-agentic-ai; Jan-Frederick Gohsl, Future Proofing the DMA for Agentic AI: Lessons from the AI Act, 48 World Competition 315 (2025).

[13] See, e.g., TokenRing AI, The Search Wars of 2026: ChatGPT’s Conversational Surge Challenges Google’s Decades-Long Hegemony, WRAL (2026), https://markets.financialcontent.com/wral/article/tokenring-2026-1-2-the-search-wars-of-2026-chatgpts-conversational-surge-challenges-googles-decades-long-hegemony (reporting that ChatGPT Search captured roughly 17–18 per cent of global search queries by early 2026).

[14] The same risk may also arise where a partnership involves two large incumbents. See, e.g., Press Release, Google, Joint Statement from Google and Apple, Google Blog (12 January 2026), https://blog.google/company-news/inside-google/company-announcements/joint-statement-google-apple (announcing a multiyear collaboration under which Apple will build next-generation foundation models on Google’s Gemini models to power future Apple Intelligence features, including a more personalised Siri).

[15] See, e.g., Org. for Econ. Co-operation & Dev. (OECD), Competition in Artificial Intelligence Infrastructure (2025), https://www.oecd.org/en/publications/competition-in-artificial-intelligence-infrastructure_623d1874-en.html.

[16] OpenAI, Introducing Apps in ChatGPT and the New Apps SDK (6 October 2025), https://openai.com/index/introducing-apps-in-chatgpt?utm_source=chatgpt.com.

[17] Jaewon Kang, Walmart Partners With OpenAI to Offer Shopping on ChatGPT, Bloomberg (14 October 2025), https://www.bloomberg.com/news/articles/2025-10-14/walmart-partners-with-openai-to-offer-shopping-on-chatgpt.

[18] See, e.g., Press Release, PayPal, OpenAI and PayPal Team Up to Power Instant Checkout and Agentic Commerce in ChatGPT (2025), https://newsroom.paypal-corp.com/2025-10-28-OpenAI-and-PayPal-Team-Up-to-Power-Instant-Checkout-and-Agentic-Commerce-in-ChatGPT.

[19] See, e.g., Vidhya Srinivasan, New Tech and Tools for Retailers to Succeed in an Agentic Shopping Era, Google (11 January 2026), https://blog.google/products/ads-commerce/agentic-commerce-ai-tools-protocol-retailers-platforms.

[20] See, e.g., Press Release, Conselho Administrativo de Defesa Econômica (CADE), CADE to Investigate Big Techs’ Acquisitions of AI Startups (2024), https://www.gov.br/cade/en/matters/news/cade-to-investigate-big-techs2019-acquisitions-of-ai-startups; Press Release, Eur. Comm’n, Commission Launches Calls for Contributions on Competition in Virtual Worlds and Generative AI (2024), https://ec.europa.eu/commission/presscorner/detail/en/IP_24_85; Press Release, Eur. Comm’n, U.K. Competition & Mkts. Auth. (CMA), U.S. Dep’t of Just., & Fed. Trade Comm’n, Joint Statement on Competition in Generative AI Foundation Models and AI Products (2024), https://competition-policy.ec.europa.eu/about/news/joint-statement-competition-generative-ai-foundation-models-and-ai-products-2024-07-23_en; Press Release, U.K. Competition & Mkts. Auth., CMA Seeks Views on AI Partnerships and Other Arrangements (2024), https://www.gov.uk/government/news/cma-seeks-views-on-ai-partnerships-and-other-arrangements; Press Release, Fed. Trade Comm’n, FTC Launches Inquiry into Generative AI Investments and Partnerships (2024), https://www.ftc.gov/news-events/news/press-releases/2024/01/ftc-launches-inquiry-generative-ai-investments-partnerships.

[21] See, e.g., Austl. Competition & Consumer Comm’n (ACCC), supra note 5; Autorité de la Concurrence, supra note 5; Klaus Kowalski, Cristina Volpin & Zsolt Zombori, Competition in Generative AI and Virtual Worlds, Eur. Comm’n, Competition Pol’y Brief No. 3 (2024), https://op.europa.eu/en/publication-detail/-/publication/5530c8ca-7a1f-11ef-bbbe-01aa75ed71a1/language-en; U.K. Competition & Mkts. Auth. (CMA), supra note 5. See also, e.g., Dirk Auer & Mario Zúñiga, AI Partnerships and Competition: Damned if You Buy, Damned if You Don’t, Int’l Ctr. for L. & Econ. (2025), https://laweconcenter.org/resources/ai-partnerships-and-competition-damned-if-you-buydamned-if-you-dont; Josef Drexl & Daria Kim, AI Innovation Competition as a Discovery Procedure: The Role and Limits of Competition Law (2025), https://papers.ssrn.com/sol3/papers.cfm?abstract_id=5439660.

[22] See, e.g., Autorité de la Concurrence, supra note 4; Austl. Competition & Consumer Comm’n (ACCC), supra note 5; Autorité de la Concurrence, Opinion on the Competitive Functioning of the Generative Artificial Intelligence Sector, supra note 5; U.K. Competition & Mkts. Auth. (CMA), AI Foundation Models: Initial Report (2023), https://www.gov.uk/government/publications/ai-foundation-models-initial-report; Autoridade da Concorrência, supra note 5; Body of Eur. Regulators for Elec. Commc’ns (BEREC), BEREC High-Level Position on Artificial Intelligence and Virtual Worlds, BOR (24) 68 (2024).

[23] See, e.g., Margrethe Vestager, Making Artificial Intelligence Available to All—How to Avoid Big Tech’s Monopoly on AI?, Eur. Comm’n (2024), https://ec.europa.eu/commission/presscorner/detail/en/speech_24_931.

[24] Autorità Garante della Concorrenza e del Mercato (AGCM), Decision No. 31634, Case A576, Meta AI (22 July 2025) (noting that Meta later offered the service as a standalone product at meta.ai and, at least in the United States and Canada, through a dedicated iOS and Android app).

[25] Id. ¶¶ 4, 6.

[26] Id., ¶ 7.

[27] Id., ¶¶ 8, 10.

[28] Id., ¶ 42.

[29] Id., ¶ 43.

[30] Id., ¶ 45.

[31] See, e.g., Case C-233/23, Alphabet Inc. & Others v. Autorità Garante della Concorrenza e del Mercato (Android Auto), EU:C:2025:110 (25 February 2025); Case C-48/22 P, Google LLC & Alphabet Inc. v. Eur. Comm’n (Google Shopping), EU:C:2024:726 (10 September 2024); Case C-252/21, Meta Platforms Inc. v. Bundeskartellamt, EU:C:2023:537 (4 July 2023).

[32] Case T-201/04, Microsoft Corp. v. Eur. Comm’n, EU:T:2007:289 (Gen. Ct. 17 September 2007).

[33] Id., ¶ 1036.

[34] Eur. Comm’n, Case AT.40099, Google Android (18 July 2018), confirmed by Case T-604/18, Google LLC v. Eur. Comm’n, EU:T:2022:541 (Gen. Ct. 14 September 2022).

[35] Eur. Comm’n, Case AT.40684, Facebook Marketplace (14 November 2024).

[36] Id., ¶ 820.

[37] Id., ¶ 821.

[38] United States et al. v. Google LLC, 747 F. Supp. 3d 1 (D.D.C. 2024).

[39] In re Google Play Store Antitrust Litig., No. 20-CV-05671-JD, 2024 WL 4438249 (N.D. Cal. 7 October 2024), aff’d, 147 F.4th 917 (9th Cir. 2025), modified, 152 F.4th 1078 (9th Cir. 2025).

[40] See, e.g., Press Release, Autorità Garante della Concorrenza e del Mercato (AGCM), The Italian Competition Authority Opens Procedure for the Adoption of Interim Measures Against Meta over Abuse of a Dominant Position (2025), https://en.agcm.it/en/media/press-releases/2025/11/A576.

[41] See, e.g., Press Release, Autorità Garante della Concorrenza e del Mercato (AGCM), The Italian Competition Authority Orders Meta to Suspend the Terms Excluding Competing AI Chatbots from WhatsApp (2025), https://en.agcm.it/en/media/press-releases/2025/12/A576.

[42] See, e.g., Conselho Administrativo de Defesa Econômica (CADE), Cade Abre Inquérito Contra Meta e Aplica Medida Preventiva Suspendendo Novos Termos do WhatsApp sobre IA (2026), https://www.gov.br/cade/pt-br/assuntos/noticias/cade-abre-inquerito-contra-meta-e-aplica-medida-preventiva-suspendendo-novos-termos-do-whatsapp-sobre-ia; Press Release, Eur. Comm’n, Commission Notifies Meta of Possible Interim Measures to Reverse Exclusion of Third-Party AI Assistants from WhatsApp (2026), https://ec.europa.eu/commission/presscorner/detail/en/ip_26_310.

[43] See Autorità Garante della Concorrenza e del Mercato (AGCM), Decision No. 31775, Case A576, Meta AI ¶ 75 (22 December 2025).

[44] Id., ¶¶ 31-32.

[45] See Eur. Comm’n, supra note 6.

[46] See, e.g., Press Release, Eur. Comm’n, Commission Opens Proceedings to Assist Google in Complying with Interoperability and Online Search Data Sharing Obligations under the Digital Markets Act (2026), https://ec.europa.eu/commission/presscorner/detail/en/ip_26_202.

[47] See, e.g., Bostoen & Kramer, supra note 12.

[48] See, e.g., OECD, supra note 2; Gohsl, supra note 12.

[49] See, e.g., Eur. Comm’n, U.K. Competition & Mkts. Auth., U.S. Dep’t of Just., & Fed. Trade Comm’n, supra note 20.

[50] See, e.g., Eur. Comm’n, supra note 20; Kowalski, Volpin & Zombori, supra note 21.

[51] Autorità Garante della Concorrenza e del Mercato (AGCM), supra note 24, ¶ 36.

[52] Id.

[53] See, e.g., Anton Korinek & Jai Vipra, Concentrating Intelligence: Scaling and Market Structure in Artificial Intelligence, 40 Econ. Pol’y 227 (2025); Catherine Tucker, How Does Competition Policy Need to Change in a World of Artificial Intelligence?, 40 Oxford Rev. Econ. Pol’y 834 (2024).

[54] See, e.g., Andrei Hagiu & Julian Wright, Artificial Intelligence and Competition Policy, 103 Int’l J. Indus. Org. 103134 (2025); Korinek & Vipra, supra note 53; Zach Meyers & Marc Bourreau, A Competition Policy for Cloud and AI, Centre on Regulation in Europe (CERRE) (2025), https://cerre.eu/publications/acompetition-policy-for-cloud-and-ai; Thibault Schrepel & Alex “Sandy” Pentland, Competition Between AI Foundation Models: Dynamics and Policy Recommendations, 34 Indus. & Corp. Change 1085 (2025). See also Austl. Competition & Consumer Comm’n (ACCC), supra note 5, at 292; Autorité de la Concurrence, supra note 5, at 5.

[55] See, e.g., Kate Clark, Anthropic Raising $10 Billion at $350 Billion Value, Wall St. J. (7 January 2026), https://www.wsj.com/tech/ai/anthropic-raising-10-billion-at-350-billion-value-62af49f4.

[56] Meyers & Bourreau, supra note 54.

[57] Id.

[58] Geoffrey A. Manne & Dirk Auer, From Data Myths to Data Reality: What Generative AI Can Tell Us About Competition Policy (and Vice Versa), CPI Antitrust Chron. (February 2024); see, e.g., CB Insights, Artificial Intelligence (AI) Unicorns Worldwide in 2nd Quarter 2025, by Valuation (2025), https://www.statista.com/statistics/1621613/artificial-intelligence-unicorns-worldwide (showing an AI-startup ecosystem led by ByteDance and OpenAI at roughly $300 billion valuations, followed by Stripe ($70 billion), Databricks and Anthropic ($62 billion each), and xAI ($50 billion)).

[59] See Roland Berger, Most Popular Artificial Intelligence (AI) Applications Worldwide in February 2025, by Monthly Active Users, Statista (2025), https://www.statista.com/statistics/1609163/top-ai-applications-mau-worldwide (reporting that the ByteDance-owned chatbot Doubao reached about 82 million monthly active users, with ChatGPT’s Nova Assistant at roughly 63 million and DeepSeek at about 62 million; a second group—Remini, Talkie AI, Character AI, ChatOn, Genius, and Gemini—each recorded about 28–33 million users); see also Similarweb, 2025 Generative AI Landscape: The State of Gen AI (2025), https://www.similarweb.com/corp/2025-generative-ai-landscape (finding that ChatGPT leads U.S. usage with more than 41 million monthly active users and a 33 per cent stickiness rate, while rivals such as Perplexity, Copilot, and Gemini have smaller user bases and lower engagement).

[60] Semrush, Artificial Intelligence (AI) Chatbots Worldwide Market Share from April 2024 to March 2025 (2025), https://www.statista.com/statistics/1618020/ai-chatbots-traffic-share-ww.

[61] See Similarweb, supra note 59 (reporting that in September 2025 Google received about 82 billion monthly visits worldwide, followed by YouTube at roughly 29 billion, Facebook at about 11 billion, Instagram at approximately 6.5 billion, and ChatGPT at around 6 billion).

[62] See AppMagic, Most Downloaded Generative AI Mobile Apps Worldwide as of 27 November 2025, Statista (2025), https://www.statista.com/statistics/1554189/top-gen-ai-apps-by-downloads (showing Google Gemini with about 392 million downloads, followed by Cici (169 million), DeepSeek (158 million), Perplexity (95 million), and Grok (82 million)).

[63] See Stack Overflow, Most Used Artificial Intelligence (AI) Search and Developer Tools Among Developers Worldwide as of 2024, Statista (2024), https://www.statista.com/statistics/1483838/ai-tools-usage-among-developers-use-worldwide (reporting GitHub Copilot usage at 44 per cent, Google Gemini at 22 per cent, Bing AI at 14 per cent, and Visual Studio IntelliCode at 13.7 per cent, with lower adoption for Claude (7.6 per cent) and Perplexity AI (4.9 per cent)).

[64] See Similarweb, AI Global—Global Sector Trends on Generative AI (2026), https://www.similarweb.com/corp/wp-content/uploads/2026/01/attachment-Global-AI-Tracker-6.pdf?utm_medium=social&utm_source=twit (reporting lower market shares for rivals, including DeepSeek (3.7 per cent), Grok (3.4 per cent), Perplexity (2.0 per cent), Claude (2.0 per cent), and Copilot (1.1 per cent)).

[65] Bradley Olson, The Week Anthropic Tanked the Market and Pulled Ahead of Its Rivals, Wall St. J. (5 February 2026), https://www.wsj.com/tech/ai/the-week-anthropic-tanked-the-market-and-pulled-ahead-of-its-rivals-ef59dff1; George Hammond, Anthropic’s Breakout Moment: How Claude Won Business and Shook Markets, Fin. Times (6 February 2026), https://www.ft.com/content/a75555a6-24c3-4468-aba9-7fe12b5def31.

[66] U.K. Competition & Mkts. Auth. (CMA), supra note 22, ¶ 4.17.

[67] Semrush, supra note 60.

[68] Similarweb, supra note 64.

[69] Stack Overflow, supra note 63.

[70] United States et al. v. Google LLC, No. 20-cv-3010 (APM) (D.D.C. 2025).

[71] Id.

I. Introduction

We appreciate the opportunity to comment on the Competition & Markets Authority’s (CMA) call for evidence (the Call for Evidence)[1] in connection with its Merger Efficiencies Review. The International Center for Law & Economics (ICLE) is a nonprofit, nonpartisan global research and policy centre dedicated to building the intellectual foundations for sensible, economically grounded policy. ICLE promotes law & economics methodologies to inform public-policy debates and has longstanding expertise in competition law and policy. These comments aim to help ensure that competition law remains grounded in clear rules, established precedent, sound evidence, and economic analysis. ICLE has also submitted views on related issues to the Canadian Competition Bureau regarding its draft merger guidelines.[2]

We commend the CMA’s adoption of the ‘4Ps’ framework.[3] A merger-control regime focused on pace, predictability, proportionality, and process aligns with a law & economics approach and supports markets in delivering lower prices, higher quality, innovation, and consumer welfare.

The CMA’s review presents an opportunity to clarify how efficiencies should be assessed in practice. Because merger review is inherently prospective, both harms and benefits depend on projections about future competitive conditions. The framework should therefore treat uncertainty consistently, avoid systematically discounting longer-term benefits, and recognise that innovation, investment, and integration often generate consumer welfare over extended horizons.

Our recommendations are as follows:

• Preserve flexibility and analytical symmetry in the assessment of efficiencies, particularly with respect to timing. Where theories of harm rely on medium- or long-term projections, efficiencies over comparable horizons should be admissible and evaluated under similar evidentiary standards.
• Adopt a balanced approach to sufficiency by considering both likelihood and magnitude. Dynamic and innovation-related efficiencies should not be discounted relative to more immediate static effects.
• Interpret merger specificity pragmatically, focusing on whether efficiencies could realistically be achieved through less anticompetitive alternatives rather than requiring narrow ‘buyer-specific’ proof. Evidence from comparable transactions and industry experience should be relevant.
• Clarify that efficiencies are not suspect merely because they strengthen competitive performance. Efficiencies that allow firms to compete more effectively—through lower costs, improved quality, or greater innovation—benefit consumers even if rivals lose sales.
• Apply consistent and proportionate evidentiary standards to harms and efficiencies. Internal documents, forward-looking plans, and qualitative evidence should be probative when assessing efficiency claims, just as they are when assessing theories of harm.
• Give appropriate weight to dynamic efficiencies and innovation, particularly in sectors characterised by high fixed costs, rapid technological change, and complementarities. Context-specific analysis reduces the risk of deterring pro-investment and pro-innovation transactions.

The sections that follow elaborate on these points by addressing timeliness, the balancing of harms and benefits across time and customer groups, merger specificity, pass-through to consumers, evidentiary standards, and the treatment of dynamic efficiencies.

II. Framework for Assessing Merger Efficiencies

The CMA applies a structured framework to merger efficiencies. Once it identifies a realistic prospect of competitive harm, the merging parties must show that the claimed efficiencies are rivalry-enhancing, timely, likely and sufficient, and merger-specific. The resulting benefits must also accrue to UK consumers. This section addresses each of these analytical steps and offers recommendations to improve their practical application.

Our comments focus on how the framework operates in practice. First, the assessment should treat uncertainty symmetrically: the evidentiary standards applied to long-horizon harms should also apply to long-horizon efficiencies. Second, the CMA should adopt a transparent approach to weighing harms and benefits across time horizons, competitive parameters, and affected customer groups, including cases involving innovation and two-sided markets.

Third, merger specificity should be evaluated with attention to real-world organisational constraints. Contractual alternatives such as licensing or joint ventures may not replicate the integration benefits of a merger, and the analysis should not impose unduly narrow buyer-specificity requirements. Fourth, evaluation of consumer benefit should centre on residual competitive pressure, including entry conditions and potential competition, which determine whether efficiencies are passed through to consumers.

Finally, guidance should clarify that efficiencies are not suspect merely because they strengthen the merged firm’s ability to compete. Competition law protects the competitive process, not individual competitors. Clearer treatment of these issues would improve predictability, align the framework with legal and economic evidence, and encourage parties to present well-supported efficiency claims.

A. Temporal Symmetry in Assessing Efficiencies

The CMA seeks views on the factors it should consider when assessing the timeliness of merger efficiencies.[4] The current Merger Assessment Guidelines (MAGs) state that the CMA ‘will assess whether the claimed efficiencies are to be realised (and the resultant rivalry-enhancing effects felt) within the same timeframe as the CMA has adopted in the rest of its analysis’.[5] This language is constructive because it recognises a principle of temporal symmetry between harms and efficiencies. The MAGs do not prescribe a fixed timeframe, and that flexibility should be preserved.

The MAGs then qualify the symmetry principle: ‘usually the longer the time period necessary for efficiencies to be realised, the greater will be the level of doubt that efficiencies will be realised at all’.[6] This qualification effectively applies a rising scepticism discount to efficiencies. The Guidelines include no comparable qualification for theories of harm. Instead, they state that the CMA ‘will generally take a forward-looking approach to the assessment of any theories of harm, considering the effects of the merger both now, and in the future’.[7]

In practice, the CMA routinely evaluates long-horizon harms. When analysing potential competition—e.g., whether a firm ‘would have entered or expanded and could be expected to become a strong competitor’ absent the merger[8]—or assessing market-tipping risks in platform markets, the CMA projects competitive effects years ahead without applying an escalating doubt discount. The Guidelines therefore embed a structural asymmetry: long-term harms receive forward-looking treatment, while long-term efficiencies face progressive discounting based solely on time. The review should consider whether this one-directional scepticism is justified, or whether uncertainty should be treated symmetrically on both sides of the competitive assessment.

A more coherent approach—already implicit in the MAGs—is to apply equal evidentiary treatment. If a theory of harm relies on projected anticompetitive effects several years in the future, efficiencies expected over a comparable horizon should be admissible. Aligning the treatment of harms and benefits would improve analytical consistency and the credibility of the assessment.[9]

Timeliness should also reflect industry dynamics. In fast-moving sectors, market forces may mitigate short-term concerns, while longer-term competitive developments become decisive. Efficiencies may therefore materialise quickly and alleviate competitive risks. In industries with long development cycles, by contrast, a longer horizon for efficiencies is realistic and often necessary. As the OECD recognises, ‘mergers have a positive long-run impact on performance by creating efficiencies or synergies, even though such effects can take several years to materialize’.[10]

B. Weighing Harms and Efficiencies Across Time, Parameters, and Customers

The CMA also asks how it should evaluate claimed efficiencies when determining whether they offset potential anticompetitive effects, particularly where harms and benefits arise over different time horizons, affect different competitive parameters, or fall on different groups of customers.[11]

Balancing harms and efficiencies is inherently uncertain in merger enforcement. The task becomes more difficult when near-term harms must be weighed against more distant benefits. Static efficiencies may arise quickly but often generate modest welfare gains. Dynamic efficiencies—often associated with innovation—typically take longer to materialise but may produce substantially larger benefits.

One useful approach is analogous to risk-regulation frameworks that evaluate trade-offs along two dimensions: likelihood and impact. Short-term harms may be relatively certain yet limited in magnitude, while long-term efficiencies may be less certain but potentially transformative.[12] Explicitly assessing both probability and expected impact, to the extent feasible in a given case, would improve transparency and avoid systematically discounting longer-term efficiencies solely because of timing. It would also allow the CMA to capture the full value of efficiencies, while maintaining appropriate caution regarding short-term consumer harm.

Similar issues arise when harms and efficiencies affect different competitive parameters. A common example involves short-term price effects alongside longer-term innovation benefits. Such cases inevitably require policy judgement. Recent developments in UK competition policy—including greater emphasis on growth, investment, and innovation—reflect increasing recognition of dynamic competition. Careful evaluation of innovation-related efficiencies is therefore consistent with both economic evidence and evolving policy priorities.[13] The CMA’s assessment in the Vodafone/Three merger,[14] where potential price effects were considered alongside longer-term infrastructure investment and innovation commitments, illustrates the relevance of this balancing exercise.

Mergers may also affect customer groups unevenly, whether geographically or temporally. A merger may raise prices in certain local markets while enabling nationwide investment that benefits consumers more broadly. In other cases, environmentally oriented innovation may increase short-term costs while generating longer-term consumer benefits through improved products or reduced environmental harm.[15] Similar issues arise in two-sided markets, where disadvantages to one side of market participants may coincide with benefits to another.[16] These ‘out-of-market efficiency’ scenarios underscore the need to assess efficiencies across relevant customer groups and time horizons, rather than focusing narrowly on immediate effects.[17] Where such mismatches arise, the CMA’s policy mandate supports giving appropriate weight to nationwide and longer-term efficiencies.

C. Assessing Merger Specificity

The CMA also seeks views on how merger specificity should be assessed. The requirement reflects the principle that efficiencies must arise from the merger itself, rather than from less restrictive alternatives, such as licensing agreements or joint ventures.

Economic and management research suggests this assessment should be applied cautiously.[18] As the Call for Evidence recognises, practical barriers may prevent firms from achieving comparable efficiencies through contractual arrangements.[19] Transaction-cost economics shows that licensing agreements and joint ventures can be costly to negotiate, implement, and monitor.[20] They may also create dependence on jointly developed assets or specialised knowledge, increasing the risk of disputes or opportunistic behaviour. Anticipating these risks, firms may forgo such arrangements altogether, meaning the efficiencies would not materialise absent the merger.

Management literature likewise treats partnerships and mergers as distinct organisational modes, not functional substitutes. Partnerships typically involve complementary specialisation and limited coordination. Mergers enable deeper integration and broader deployment of resources.[21] While both structures can generate efficiencies, they are not reliably interchangeable.[22] The CMA should therefore avoid assuming that efficiencies achievable through integration can readily be replicated through contractual alternatives.

Efficiency claims should also not be required to be ‘buyer-specific’ in an unduly narrow sense. Where multiple plausible acquirers could generate comparable efficiencies, that should satisfy the merger-specificity requirement. The parties should also be able to rely on evidence from comparable transactions within the industry.

Finally, willingness to pay can be informative. If an acquirer offers a materially higher price than other plausible bidders, that may provide corroborating—though not conclusive—evidence that the buyer expects to realise greater value from the transaction. Such expectations often reflect complementarities, scale economies, or integration efficiencies that the acquirer believes it can deploy more effectively than alternative purchasers.

D. Pass-Through and Residual Competitive Pressure

Finally, the CMA seeks views on how it should assess whether efficiencies are likely to benefit consumers, particularly through the pass-through of cost savings or quality improvements.[23] This assessment is necessarily contextual.

The key factor is the degree of residual competitive pressure after the merger. Consumer harm arises when competitive pressure weakens; consumer benefit arises only where sufficient pressure remains to induce firms to pass on efficiency gains. Evaluating that pressure requires a case-specific assessment of market structure, entry conditions, and the transaction’s strategic rationale. Where a merger aims to strengthen competition against a larger incumbent or enable entry into new markets, the merged firm will often have strong incentives to translate efficiencies into lower prices, improved quality, or greater innovation. Where a merger substantially increases market power, pass-through becomes less likely.[24]

Entry conditions and potential competition therefore warrant particular attention. In technologically dynamic markets, competitive constraints often come not only from existing rivals but also from potential entrants and rapid innovation cycles. These forces can both discipline firms to pass on efficiencies and help explain why efficiency-seeking mergers occur in the first place.[25] Recognising these features would allow the CMA to evaluate efficiency claims more realistically in sectors characterised by rapid technological change.

E. Efficiencies, Rival Harm, and the Competitive Process

The Call for Evidence notes that some stakeholders have expressed concern that ‘the CMA might consider that the efficiencies could reduce rivals’ ability to compete effectively with the merged entity’, creating a ‘barrier to submitting efficiency claims’.[26]

There is no indication that this concern reflects actual CMA policy. Nonetheless, updated guidance could usefully clarify that efficiencies will not be treated negatively merely because they strengthen the merged firm’s competitive position. Historically, some authorities in the United States and the European Union were sceptical of merger-efficiency arguments and occasionally treated them as suspect.[27] That approach changed as agencies and courts adopted a more economic framework. As the U.S. Department of Justice explained: ‘challenging a merger because it will create a more efficient firm through economies of scale and scope is at odds with the fundamental objectives of the antitrust laws’.[28]

The relevant distinction is between efficiencies that disadvantage rivals by benefiting consumers—through lower prices, improved quality, or greater innovation—and conduct that harms rivals by distorting or blocking competition. The former is procompetitive and should be credited. Efficiencies that enable a firm to offer consumers a better deal reflect the competitive process operating as intended. As the DOJ further observed: ‘efficiency and aggressive competition benefit consumers, even if rivals that fail to offer an equally “good deal” suffer loss of sales or market share’.[29]

Discouraging such transactions would protect competitors rather than competition, which would be inconsistent with modern economic understanding and with the CMA’s stated objective of supporting growth and investment.

III. Evidentiary Standards for Efficiencies

Merger control differs from conduct investigations because it evaluates effects that have not yet occurred. The prospective nature of the analysis makes both the production and assessment of evidence more difficult. The CMA therefore asks what types and extent of evidence it should consider when assessing efficiencies, and whether evidential standards should vary depending on the nature of the claimed efficiencies.[30]

No single answer fits every case. Each merger arises in a distinct competitive setting, and the evidence needed to substantiate efficiencies will vary across transactions. The CMA should therefore retain a flexible approach to evidential submissions. Analytical symmetry provides a useful organising principle. Evidence the CMA treats as sufficiently probative when evaluating potential harms—such as internal business documents, forward-looking projections, and strategic planning materials—should also be admissible to substantiate efficiency claims. If internal documents support a theory of harm, particularly in innovation-focused cases, comparable materials should also support an efficiency claim.

The same principle applies to longer-term efficiencies. Such claims inevitably involve uncertainty, but uncertainty is not unique to efficiencies. The CMA routinely evaluates long-run theories of harm that depend on extended time horizons and uncertain outcomes. In those cases, the agency relies on coherent documentary evidence, industry analysis, and economic reasoning[31] Applying comparable evidential standards to efficiencies would improve consistency. Parties can mitigate uncertainty by grounding claims in contemporaneous business plans, sectoral analyses tracking expected technological developments, or investment commitments that credibly bind them to future action.[32] This evidence will not eliminate uncertainty, but it can demonstrate that claimed efficiencies are plausible and tied to observable commercial incentives.

The CMA also asks whether qualitative and quantitative evidence should receive different weight.[33] A general preference for either would be inappropriate. The relevant evidential mix depends on the nature of the claimed efficiency and the characteristics of the industry. Short-term cost savings often lend themselves to quantitative substantiation through cost modelling, projected scale economies, or financial forecasts. Some longer-term efficiencies may also be partly quantifiable, such as achieving minimum efficient scale or measurable productivity gains. Innovation-related efficiencies are less amenable to precise quantification. Claims that a merger will accelerate product development, enable new technological trajectories, or combine complementary capabilities will rely more heavily on qualitative evidence, including internal strategy documents and technological roadmaps.[34] Such evidence should not be discounted merely because precise quantification is difficult. Instead, the CMA should evaluate it in light of the transaction’s commercial rationale and the broader industry context.

A case-specific, context-sensitive approach, combined with symmetry between the treatment of harms and efficiencies, would improve both credibility and practical administrability. It would also reduce the risk that significant efficiencies are overlooked simply because they cannot be demonstrated with the same quantitative precision as short-term price effects. This approach aligns with the CMA’s objective of supporting growth and investment.

IV. Assessing Dynamic Efficiencies and Innovation Effects

The CMA’s final substantive question concerns the challenges of assessing and evidencing dynamic efficiencies. These are understood as benefits that generate ‘long-term benefit to customers by increasing the merged firms’ ability and incentive to innovate, invest or undertake research and development to improve the quality of products/services, introduce new products/services or improve production processes’.[35]

Mergers can affect competition not only through short-term price effects but also through innovation and investment. The CMA’s focus on dynamic efficiencies is therefore welcome. Assessing such efficiencies, however, raises conceptual and evidentiary issues distinct from those associated with static cost savings. The analytical framework should ensure that potentially significant innovation benefits are not systematically discounted.

Dynamic efficiencies are inherently uncertain. Predicting future benefits requires evaluating firms’ incentives, capabilities, and technological environment, rather than extrapolating from current market conditions. In this respect, dynamic-efficiency analysis resembles innovation-based theories of harm. Authorities regularly assess possible reductions in innovation rivalry using imperfect evidence. Comparable evidentiary tolerance is therefore appropriate when considering potential innovation benefits.

Mergers may enhance innovation where they combine complementary assets, capabilities, or resources that are difficult to coordinate contractually. Economic and management research emphasises that innovation often depends on integrating technological know-how, financial resources, data assets, and organisational capabilities within a single governance structure.[36] Where such complementarities exist, mergers can strengthen both the ability and incentives to invest in R&D. A merger that accelerates innovation or combines complementary capabilities may intensify competition over time, even if concentration increases in the short term. Gregory Sidak and David Teece similarly argue that a ‘neo-Schumpeterian’ approach places less weight on market share and greater weight on potential competition and firm capabilities.^[37]

Scale also matters in innovation-intensive sectors characterised by high fixed costs. Achieving sufficient scale may enable firms to undertake projects that would otherwise be technically or financially infeasible. Larger integrated firms may also better absorb the risks associated with uncertain innovation outcomes and therefore sustain long-term investment.[38]

Fixed-cost efficiencies may not immediately lower prices, but they affect investment incentives, risk tolerance, and capacity expansion. Focusing exclusively on short-term price effects risks understating long-run competitive benefits. Oliver Williamson demonstrated that merger analysis should weigh scale economies against deadweight loss to avoid significant economic waste.^[39]

Mergers can also facilitate access to intangible capital, including expertise, reputation, customer relationships, and technological infrastructure.[40] Smaller innovative firms often develop novel technologies but lack the resources required for commercialisation. Integration with a larger partner can accelerate deployment. This pattern appears frequently in technology-intensive industries, including pharmaceuticals, where acquisitions often support long-term development and market introduction.[41]

Evaluating dynamic efficiencies requires a broader evidentiary toolkit than static efficiency analysis. Quantification is often difficult because outcomes depend on uncertain technological trajectories, evolving consumer preferences, and rivals’ responses. Nonetheless, several forms of evidence can support such claims. Internal business documents and strategic plans—such as R&D roadmaps, investment plans, assessments of technological complementarities, and integration strategies—provide a natural starting point. Industry studies and sector reports can contextualise technological trends and competitive dynamics.[42] Historical evidence from comparable transactions may also offer useful benchmarks.

Merger specificity should also be assessed in a commercially realistic manner. The CMA asks whether efficiencies could be achieved ‘by other means’, including independent investment or licensing.[43] EU guidance similarly examines whether less anticompetitive but realistic alternatives would produce comparable efficiencies. In dynamic-efficiency cases, the central question often concerns timing and governance: whether alternative arrangements could plausibly deliver equivalent integration of complementary intangible assets and coordinated investment within the relevant timeframe.

Finally, qualitative evidence should not be discounted automatically. Innovation effects often manifest through changes in organisational capability, technological direction, or strategic positioning, which cannot readily be captured through numerical forecasts. A balanced evidentiary approach that considers both qualitative and quantitative sources will produce more accurate assessments.

V. Conclusion

Merger-efficiency assessment should rest on sound economic analysis and reflect the realities of modern markets. Evaluating efficiencies is inherently forward-looking and uncertain, particularly where investment, innovation, and long-run competitive dynamics are involved. Merger control should therefore avoid rigid or formalistic requirements that exclude relevant evidence or systematically discount longer-horizon benefits. A case-specific, context-sensitive approach provides a more reliable basis for decision-making.

Several principles follow. The CMA should apply analytical symmetry between harms and efficiencies: when theories of harm rely on projections about future entry, innovation, or market tipping, comparable projections should be acceptable when supported efficiency claims are presented. Efficiencies should not be discounted merely because they materialise over longer timeframes or resist precise quantification. Assessment should instead consider probability and expected magnitude, as well as residual competitive pressure that determines whether benefits are passed through to consumers.

Merger specificity also requires a commercially realistic application. The question is whether comparable efficiencies could plausibly be achieved through less anticompetitive alternatives, not whether they are unique to a particular buyer. Contractual arrangements, such as licensing or joint ventures, often cannot replicate the integration of complementary assets, governance, and investment incentives that a merger provides. Recognising this reduces the risk of false negatives that deter welfare-enhancing transactions. Guidance should also clarify that efficiencies are not suspect merely because they strengthen the merged firm’s ability to compete; competition law protects the competitive process, not individual competitors.

Evidentiary standards should remain flexible and consistent. Internal documents, business plans, industry analysis, and qualitative evidence may all be probative, particularly for dynamic efficiencies that cannot be reduced to short-term price effects. A balanced approach reduces the risk that innovation benefits, scale economies, and intangible-capital integration are overlooked.

These recommendations align with the CMA’s ‘4Ps’ framework. Clear and symmetric standards improve predictability for parties and stakeholders. Proportionate evidentiary expectations facilitate timely engagement on efficiencies and improve pace. A flexible, economically grounded analysis supports proportionality by calibrating enforcement to likely competitive effects. Finally, transparent treatment of efficiencies strengthens the review process and reinforces confidence that merger decisions promote growth, investment, and long-term consumer welfare.

[1] Competition & Markets Auth., Merger Efficiencies Review: Call for Evidence (15 January 2026), https://connect.cma.gov.uk/call-for-evidence-merger-efficiencies-review (‘Call for Evidence’).

[2] Ian Adams, Eric Fruits, Brian Albrecht, Daniel J. Gilman & Geoffrey A. Manne, Comments of the International Center for Law & Economics to the Competition Bureau of Canada: Proposed Merger Enforcement Guidelines (10 February 2026), https://laweconcenter.org/wp-content/uploads/2026/02/Competition-Bureau-Canada-Merger-Comments-2026.pdf.

[3] Call for Evidence, supra note 1, at 2.

[4] Call for Evidence, supra note 1, at 7.

[5] Competition & Markets Auth., Merger Assessment Guidelines 61 (18 March 2021), https://assets.publishing.service.gov.uk/media/61f952dd8fa8f5388690df76/MAGs_for_publication_2021_–_.pdf.

[6] Id. ¶ 8.12.

[7] Id. ¶ 2.10.

[8] Id. ¶ 2.18(b).

[9] See Mario Todino, Geoffroy van de Walle & Lucia Stoican, EU Merger Control and Harm to Innovation—A Long Walk to Freedom (from the Chains of Causation), 64 Antitrust Bull. 11 (2019) (making a similar call in the context of EU merger regulation).

[10] Org. for Econ. Co-operation & Dev., Merger Control in Dynamic Markets 12 (10 March 2020), https://www.oecd.org/en/publications/merger-control-in-dynamic-markets_d3752037-en.html.

[11] Call for Evidence, supra note 1, at 7.

[12] Dirk Auer, Innovation Defenses and Competition Laws: The Case for Market Power (2019) (Ph.D. dissertation, Univ. of Liège), https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4667754.

[13] Ufuk Akcigit & John Van Reenen, The Economics of Creative Destruction: New Research on Themes from Aghion and Howitt (Harv. Univ. Press 2023).

[14] Competition & Markets Auth., Merger Investigation into the Anticipated Joint Venture Between Vodafone Group plc and CK Hutchison Holdings Ltd. Concerning Vodafone Ltd. and Hutchison 3G UK Ltd.: Case Closure Summary (2 June 2025), https://assets.publishing.service.gov.uk/media/683d54fffd325db61c5ff27d/case_closure_summary.pdf.

[15] Roman Inderst & Stefan Thomas, Prospective Welfare Analysis—Extending the Willingness-to-Pay Assessment to Embrace Sustainability, 18 J. Competition L. & Econ. 551 (2022).

[16] Francesco Ducci, Out-of-Market Efficiencies, Two-Sided Platforms, and Consumer Welfare: A Legal and Economic Analysis, 12 J. Competition L. & Econ. 591 (2016).

[17] The problem of ‘out-of-market’ efficiencies is not confined to the United Kingdom. See Geoffrey A. Manne & Kristian Stout, The Evolution of Antitrust Doctrine After Ohio v. Amex and the Apple v. Pepper Decision That Should Have Been, 98 Neb. L. Rev. 425 (2019) (discussing the issue from a U.S. perspective).

[18] See, e.g., Louis Kaplow, Improving Economic Analysis in Merger Guidelines, 39 J. Econ. Persps. 29 (2025); Howard Shelanski, Efficiency Claims and Antitrust Enforcement, in The Oxford Handbook of International Antitrust Economics (Roger D. Blair & D. Daniel Sokol eds., 2015).

[19] Call for Evidence, supra note 1, at 7.

[20] See, e.g., Michael Riordan & Oliver Williamson, Asset Specificity and Economic Organization, 3 Int’l J. Indus. Org. 365 (1985); Armen A. Alchian, Specificity, Specialization, and Coalitions, 140 J. Institutional & Theoretical Econ. 34 (1984).

[21] David Mowery, Joanne Oxley & Brian Silverman, Strategic Alliances and Interfirm Knowledge Transfer, 17 Strategic Mgmt. J. 77 (1996).

[22] John Hagedoorn & Bert Sadowski, The Transition from Strategic Technology Alliances to Mergers and Acquisitions: An Exploratory Study, 36 J. Mgmt. Stud. 87 (1999).

[23] Call for Evidence, supra note 1, at 7.

[24] Even here, a sufficiently radical innovation can induce a monopolist to pass benefits to consumers (e.g., by pricing below the pre-innovation competitive level). See Kenneth J. Arrow, Economic Welfare and the Allocation of Resources for Invention, in The Rate and Direction of Inventive Activity: Economic and Social Factors (Princeton Univ. Press 1962).

[25] Michael Gort & Steven Klepper, Time Paths in the Diffusion of Product Innovations, 92 Econ. J. 630, 646 (1982).

[26] Call for Evidence, supra note 1, at 6.

[27] William J. Kolasky & Andrew R. Dick, The Merger Guidelines and the Integration of Efficiencies into Antitrust Review of Horizontal Mergers, U.S. Dep’t of Justice (2003), https://www.justice.gov/sites/default/files/atr/legacy/2007/07/11/11254.pdf.

[28] U.S. Dep’t of Justice, Antitrust Div., Range Effects: The United States Perspective — Antitrust Division Submission for OECD Roundtable on Portfolio Effects in Conglomerate Mergers 3 (12 October 2001), https://www.justice.gov/sites/default/files/atr/legacy/2015/01/26/9550.pdf.

[29] Id. at 2.

[30] Call for Evidence, supra note 1, at 7–8.

[31] See Yossi Spiegel, The Facebook–Giphy Merger, Rev. Indus. Org. (forthcoming).

[32] The CMA adopted a similar approach in the recent Vodafone/Three merger. Comparable recommendations also appear in Mario Draghi’s report on European competitiveness.

[33] Call for Evidence, supra note 1, at 8.

[34] For example, in a prominent merger decision involving innovation considerations, the European Commission relied on extensive documentary evidence. See Nicholas Levy & Vassilena Karadakova, The EC’s Increasing Reliance on Internal Documents under the EU Merger Regulation: Issues and Implications, 39 Eur. Competition L. Rev. 12 (2018).

[35] Call for Evidence, supra note 1, at 8.

[36] David J. Teece, The Foundations of Enterprise Performance: Dynamic and Ordinary Capabilities in an (Economic) Theory of Firms, 82 Acad. Mgmt. Persps. 328 (2014).

[37] Gregory Sidak & David J. Teece, Dynamic Competition in Antitrust Law, 5 J. Competition L. & Econ. 581 (2009).

[38] See, e.g., Brian Albrecht, Geoffrey A. Manne, David J. Teece & Mario Zúñiga, From Moore’s Law to Market Rivalry: The Economic Forces That Shape the Semiconductor Manufacturing Industry, Int’l Ctr. for L. & Econ., at 30 (12 November 2025), https://laweconcenter.org/resources/from-moores-law-to-market-rivalry-the-economic-forces-that-shape-the-semiconductor-manufacturing-industry (‘… standard indicators of market power—high market shares, long-term contracts, and customer relationship “stickiness”—are likely misleading in the semiconductor context. These features often reflect the natural result of technological and economic forces rather than strategic behavior designed to exclude rivals. The semiconductor industry’s recurring pattern of competition for the market is characterized by fierce competition for technological leadership that resets with each generation, rather than a traditional winner-take-all race susceptible to permanent monopolization’).

[39] Oliver E. Williamson, Economies as an Antitrust Defense: The Welfare Tradeoffs, 58 Am. Econ. Rev. 18 (1968) (‘[I]n the occasional case where efficiency and market power consequences exist, can economies be dismissed on the grounds that market power effects invariably dominate? If they cannot, then a rational treatment of the merger question requires that an effort be made to [estimate the tradeoffs].’).

[40] Nicolas Crouzet, Janice Eberly, Andrea Eisfeldt & Dimitris Papanikolaou, The Economics of Intangible Capital, 36 J. Econ. Persps. 29 (2022).

[41] Melanie Büssgen & Tom Stargardt, To Merge or Not to Merge? The Impact of Mergers and Acquisitions on Corporate Success in the Pharmaceutical Industry, 45 Managerial & Decision Econ. 2196 (2024).

[42] Jorge Padilla, Douglas H. Ginsburg & Koren Wong-Ervin, Dynamic Competition and Antitrust: Quick-Look Inferences from the Analysis of Big Tech’s R&D Expenditure Ratios, 86 Antitrust L.J. 897 (2025).

[43] Call for Evidence, supra note 1, at 6.

The International Center for Law & Economics (ICLE) respectfully submits these comments regarding the proposed merger between Charter Communications and Cox Communications, now under review by the California Public Utilities Commission (CPUC). ICLE is a nonprofit, nonpartisan research center that applies law & economics methods to public policy. Our work seeks to ensure that competition policy and regulation rest on sound economic analysis and promote consumer welfare, particularly in dynamic, technology-driven markets such as media and telecommunications.

ICLE has written extensively about this transaction and would welcome the opportunity to provide the Commission our full issue brief.[1] As explained in that brief, the proposed merger promotes competition and consumer welfare under the Clayton Act and satisfies the Federal Communications Commission’s public-interest standard. It likewise advances the public interest in California, consistent with the Commission’s longstanding review under Cal. Pub. Util. Code § 854(a).[2]

At the national level, the transaction represents geographic expansion, not horizontal consolidation. The same holds in California. Charter and Cox largely serve distinct territories, while the combination offers potential consumer benefits from economies of scale and strengthened multimodal competition.

Although Charter and Cox have approximately 25,503 overlapping locations,[3] that figure represents an exceedingly small share of broadband service statewide. In four California markets alone, Charter passes more than 940,000 locations, underscoring that the overlap is de minimis relative to the statewide footprint.[4] These overlap estimates also typically rely on the availability of gigabit service,[5] which risks overstating competitive significance by assuming uniform consumer demand for the highest-speed tiers. In reality, broadband demand is heterogeneous, and many households meet their needs at lower speed levels.[6]

Even within the limited overlap areas, most consumers face substantial intermodal competition. Fiber providers and rapidly expanding fixed-wireless offerings increasingly constrain cable pricing and investment decisions,[7] and these technologies deploy quickly. In some locations, low-earth-orbit satellite services provide an additional alternative. Taken together, these market dynamics substantially limit any plausible concern that the transaction will meaningfully reduce competition in California broadband markets.

The merger is also expected to generate significant efficiencies that benefit California consumers. Broadband deployment and network upgrades require large capital expenditures and face regulatory, construction, and demand uncertainty. These risks increase the cost of capital and can delay or deter investment. By combining operations, the merged firm can internalize efficiencies, eliminate duplicative costs, and spread fixed investments across a larger customer base, lowering operating costs and investment risk.

Those efficiencies improve the business case for accelerated upgrades to newer cable standards, enhancing service quality for existing customers and supporting expanded deployment in areas that currently lack robust broadband options or face limited cable competition from fiber or fixed-wireless providers. For California specifically, the same efficiencies make network-hardening investments more likely in wildfire-prone regions, helping maintain connectivity during and after emergency events.

The benefits extend beyond fixed broadband. The merger would allow Charter to offer competitive mobile service in Cox service areas using Spectrum Mobile and Wi-Fi offload capabilities. The combined firm would provide an additional competitor to AT&T, Verizon, and T-Mobile. Cox video subscribers would also gain access to Charter’s video platform and features.

As detailed in the attached brief, the transaction serves the public interest in California. Ratepayers are unlikely to face higher prices, and the merger eliminates little, if any, direct competition. A stronger combined firm can more effectively deploy and upgrade high-speed internet infrastructure. Consumers also gain additional options for video and mobile services, which should intensify competition and place downward pressure on prices.

ICLE would welcome the opportunity to discuss the transaction’s consumer effects further. We attach our issue brief, “The Competitive Effects of the Proposed Charter/Cox Transaction,” for the Commission’s consideration and appreciate the opportunity to comment.

[1] Eric Fruits, Ben Sperry & Kristian Stout, The Competitive Effects of the Proposed Charter/Cox Transaction, Int’l Ctr. for L. & Econ. (Sept. 17, 2025), https://laweconcenter.org/resources/the-competitive-effects-of-the-proposed-charter-cox-transaction.

[2] Cal. Pub. Util. Code § 854(a); see also Joint Reply of Charter Commc’ns, Inc., Charter Commc’ns Holdings, LLC, Cox Enters., Inc. & Cox Cal. Telecom, LLC (U05684-C) to Protests at 3, Joint Application of Charter Commc’ns, Inc., Charter Commc’ns Holdings, LLC & Cox Enters., Inc. for Approval Pursuant to Public Utilities Code Section 854 of the Indirect Transfer of Control of Cox California Telecom, LLC (U-5684-C) (July 30, 2025).

[3] Jeff Baumgartner, FCC Urged to Slap Permanent Bans on Data Caps, Paid Peering on Charter-Cox Deal, LightReading (Nov. 21, 2025), https://www.lightreading.com/cable-technology/fcc-urged-to-slap-permanent-bans-on-data-caps-paid-peering-on-charter-cox-deal.

[4] Pub. Advocates Off., Cal. Pub. Utils. Comm’n, Technical Appendices to Broadband Competition and Pricing Strategies in California’s Urban Markets (Jan. 14, 2026), https://www.publicadvocates.cpuc.ca.gov/-/media/cal-advocates-website/files/press-room/reports-and-analyses/260114-public-advocates-appendices-to-broadband-competition-and-pricing-strategies-paper.pdf.

[5] Id.

[6] See Eric Fruits, Geoffrey A. Manne, Ben Sperry & Kristian Stout, Dynamic Competition in Broadband Markets: A 2024 Update Int’l Ctr. for L. & Econ. (June 4, 2024), https://laweconcenter.org/resources/dynamic-competition-in-broadband-markets-a-2024-update; Geoffrey A. Manne, Kristian Stout & Ben Sperry, A Dynamic Analysis of Broadband Competition: What Concentration Numbers Fail to Capture, Int’l Ctr. for L. & Econ. (June 3, 2021), https://laweconcenter.org/resources/a-dynamic-analysis-of-broadband-competition-what-concentration-numbers-fail-to-capture.

[7] Jeff Baumgartner, FWA Subscriber Share Expands Even in Areas with Multiple Fixed Wireless Options, LightReading (Oct. 22, 2025), https://www.lightreading.com/fixed-wireless-access/fwa-subscriber-share-expands-even-in-areas-with-multiple-fixed-wireless-options.

Michael Calabrese, representing New America’s Open Technology Institute (OTI), and Kristian Stout, representing the International Center for Law & Economics (ICLE), spoke via Zoom on February 19 with Jay Schwarz, Chief of the Space Bureau, with respect to the above-captioned proceeding.

We discussed the report of the LEO Satellite Policy Working Group that we jointly convened throughout 2025,[1] noting its ongoing relevance to a wide variety of work at the Space Bureau and encouraging staff to rely on it as a resource in the above-captioned and related proceedings. We expressed our view that the Working Group’s recommendations are well aligned with the goals of the above-captioned proceeding and encouraged the Commission to continue its efforts to establish a regulatory framework that will allow the nascent satellite-broadband industry to thrive.

We discussed the relevance of the Working Group’s recommendations to the Commission’s pending EPFD proceeding, particularly in relation to WRC-27. We also discussed WRC-27 Agenda Item 1.5, which will consider regulatory measures to limit unauthorized operations of non-geostationary-satellite-orbit earth stations in the fixed-satellite and mobile-satellite services, in accordance with Resolution 14 (WRC-23), and Agenda Item 1.7, which will consider studies on sharing and compatibility and develop technical conditions for the use of International Mobile Telecommunications in the frequency bands 4,400–4,800 MHz and 7,125–8,400 MHz (or parts thereof) and 14.8–15.35 GHz, taking into account existing primary services operating in these and adjacent frequency bands, in accordance with Resolution 256 (WRC-23).

Finally, we noted that spectrum policy will continue to be a significant area of focus and expressed our general support for the Commission’s spectrum-abundance agenda.

Pursuant to 47 C.F.R. § 1.1206(b), this letter is being filed with your office.

[1] See Low Earth Orbit Satellites: Policies to Promote Spectrum Sharing, Foster Competition, and Close Digital Divides, LEO Policy Working Group, Int’l Ctr. for Law & Econ. & New America (Oct. 30, 2025) [hereinafter LEO Working Group Report], https://www.newamerica.org/oti/wireless-future-project/reports/leo-satellites.